Cybersecurity
Your SSL Pinning Probably Isn't Working
Google says certificate pinning "is not recommended for Android apps." Apple says "in most cases, pinning is not necessary and should be avoided." OWASP now says the answer to "should I pin?" is "probably never." Meanwhile pinning ships in roughly half the mobile apps we audit — and on Flutter it usually protects nothing at all, because Dart does not use the platform networking stack, so the pin-set in your network_security_config.xml is never read. Here is what pinning actually buys you in 2026, whether you need it, five rules if you do, why Flutter breaks all of them, and how to find out in half an hour which of those applies to your app.
August 27, 2026
