I Spent Three Weeks Reverse Engineering a Mobile App’s API — Here’s What It Took (opens in new tab)

A while back, a client asked me a deceptively simple question: "Can you find out how our competitor's mobile app talks to its backend?" No public API docs. No Postman collection floating around GitHub. Just a Flutter app, a few permissions in the manifest, and a backend that clearly wasn't expecting anyone to come knocking. I said yes before I fully understood what I was signing up for. The First Wall: Flutter Doesn't Decompile Like a Normal App If you've reverse engineered a native Android a...