Production Android security app / Published
FlutterGuard
An offline Android app that audits a released Flutter app or APK on the device, reporting the libraries, endpoints, exposed strings and package policy it ships.
- Role
- Product owner and Android engineer
- Period
- 2026
- Status
- Published
- Stack
- Kotlin, Jetpack Compose, Material 3, Android
v0.3.4 APK published on GitHub, 2 November 2026
MIT licensed; Android 8.0+; no INTERNET permission
33 GitHub stars and 0 open issues on 3 November 2026
The problem
Flutter moves application logic out of classes.dex and into lib/<abi>/libapp.so. Tools that only read Java can miss endpoints, bundled configuration and secret-like strings that still ship in the APK.
Most mobile security tooling also assumes a workstation. The common post-build question is narrower: what does this release expose? Standing up a container, database and browser is more work than that first pass deserves.
What the app does
FlutterGuard lists installed Flutter apps or opens a single APK. It reads the package without running it and groups the result into artifact facts, library and SDK markers, endpoints and routes, exposed strings, package policy and signing evidence.
- Installed-app inventory or a single APK; no root, PC or account
- Manifest, libapp.so, flutter_assets, classes.dex, NOTICES.Z and signing material
- Package facts, permissions, exported components, backup and cleartext policy
- Endpoints, route-like strings and SDK markers with source evidence
- Secret-like values masked until deliberately revealed
- On-device reports as JSON or Markdown; history stays in private storage
How the inspection works
A Kotlin and Compose UI drives a local scan pipeline. The APK is opened as a container, the binary manifest and policy files are parsed, native libraries and assets are read as data, and each finding keeps the file or attribute that produced it.
Scans run one at a time with visible progress. The app declares no INTERNET permission, so there is no upload path and no cloud lookup. A report leaves the device only when the user exports it.
- APK container, ABI and asset inventory
- Binary manifest and package-policy parsing
- String and symbol extraction from libapp.so, with confidence
- Route candidates and endpoints grouped as leads, not a navigation graph
- Explicit export; uninstalling removes stored reports and history
- APKs only; AABs must be converted with bundletool first
Engineering decisions
Offline operation is enforced by the permission model, not a settings toggle. The manifest has no INTERNET permission, so the privacy claim is checkable against the artifact.
The product avoids turning static evidence into a verdict. Grades are triage labels, findings keep their provenance, and the interface says a match is a lead that needs verification. Secret-like values stay masked by default.
- No INTERNET permission; no analytics, crash reporting or upload path
- Static evidence only: no runtime hooking or traffic interception
- A/C/F grades as triage, not a security certification
- Masked secrets with deliberate reveal
- Signed release builds; Android 8.0+
- Private report storage with explicit JSON/Markdown export
Release and distribution
v0.3.4 was published on GitHub on 2 November 2026 as a 1.4 MB APK. The project is MIT licensed and the public repository carries 38 Kotlin test files. The Google Play listing was submitted and remains in review; the GitHub APK is the public install.
Recent builds use a new signing key, so upgrading from an older GitHub APK requires exporting reports, uninstalling and installing the new build. The release notes state that trade-off rather than hiding it.
Verified results
The project is public and the claims below are dated. Store availability and repository metrics move.
- v0.3.4 APK, 1.4 MB, published 2 November 2026
- MIT license; Android 8.0+; no INTERNET permission in the manifest
- 33 GitHub stars, 1 fork and 0 open issues on 3 November 2026
- 38 Kotlin test files in the public repository
- Google Play listing still in review on 3 November 2026; the public URL returned 404
- Limits: static inspection only; no iOS, AAB, runtime hooking or traffic interception
What I owned
- Product scope, security boundaries and finding model
- Android app in Kotlin and Jetpack Compose
- APK, manifest, libapp.so, asset and signing inspection
- Evidence grades, secret masking and JSON/Markdown reporting
- Signed release, website, privacy documentation and agent skill
Verified evidence
- v0.3.4 APK published on GitHub, 2 November 2026
- MIT licensed; Android 8.0+; no INTERNET permission
- 33 GitHub stars and 0 open issues on 3 November 2026
- 38 Kotlin test files in the public repository
- Google Play listing submitted and in review; GitHub APK is public
- Kotlin
- Jetpack Compose
- Material 3
- Android
- APK inspection
- Static analysis
Related services
Mohamed Anas Fikhi / Casablanca, Morocco
Have a similar problem?
Describe what you are working on. I will tell you whether I can help and what a sensible first step looks like.