Victoria Shutenko @DefCamp 2026: “More Secure by Default is nowhere near impossible to Bypass - Flutter demands its own approach”
Mobile architectures are shifting rapidly toward multi-platform frameworks and with that shift comes an entirely new attack surface. While developers embrace tools like Flutter for their speed and efficiency, traditional offensive testing playbooks often hit a wall when faced with compiled, non-native runtime environments. Addressing these blind spots requires breaking away from standard routines and rethinking mobile exploitation from the ground up.
At DefCamp 2026, Victoria Shutenko, Security Engineer and Penetration Tester at TechMagic, steps up to unpack this very challenge. Bringing hands-on offensive expertise across mobile, cloud, banking systems and blockchain security, Victoria takes the stage with “Breaking Flutter: A Hacker’s Guide to Mobile Apps”. Her session dives into the practical realities of Dart decompilation, custom instrumentation and overcoming client-side protections like SSL pinning.
We sat down with Victoria to discuss what makes Flutter unique under a security lens, the real cause of friction between builders and security teams, and why community spaces are essential for staying sharp in offensive security.
Your experience spans mobile and web penetration testing, cloud security, AWS, as well as work in banking and blockchain environments. Looking back at your journey so far, what has shaped you the most as a security professional, and what keeps you curious about the field today?
Security is my passion. It's a field that pushes you to grow every single day - defenses evolve constantly, and just as actively, you have to keep looking for new ways to break them. That's exactly what drives me and keeps it exciting. I'm always in a win-win situation: if I manage to break something, great, I did my job well; if I can't, that means the product is genuinely well protected. Everything in this industry moves fast and keeps evolving, and being part of that constant motion is what fuels my curiosity.
Your DefCamp 2026 talk, “Breaking Flutter: A Hacker’s Guide to Mobile Apps,” explores why traditional Android and iOS pentesting approaches do not always translate well to Flutter. What first made you realize that Flutter applications needed a different security approach?
It happened during my first Flutter pentest. I spent several days trying to bypass SSL pinning, testing one tool after another, until I finally found an approach that worked and delivered the pentest. I thought: that’s it, now I’m ready for the next one. Then a new client’s app landed on my desk – and none of my previous methods worked anymore. I had to research from scratch and dig even deeper. That’s when it clicked that Flutter isn’t just “another mobile framework” – it demands its own approach every time.
Flutter is increasingly popular because it allows developers to build cross-platform applications efficiently. From a security perspective, what changes in the attack surface when an application is built with Flutter, and what risks are most often overlooked?
I’d point to the “secure by default” nature of Flutter. It’s interesting because we’re seeing more and more Flutter apps come through for testing, and they genuinely tend to be better protected out of the box. But that’s exactly what makes them dangerous to underestimate – “more secure by default” is nowhere near “impossible to bypass,” and teams often overlook that the protections still need to be tested and hardened, not just trusted.
Your talk covers practical challenges such as reverse engineering compiled Dart code, analyzing client-side logic, and bypassing SSL pinning. Which of these areas tends to surprise security researchers the most when they first start testing Flutter applications, and why?
In many ways it feels similar to testing any other mobile app, just with different underlying logic. These days, with AI, writing Frida scripts has gotten a lot easier – and that’s actually where the surprise lies. Time is limited during an engagement, but understanding the logic well enough to write the correct script still takes real time, even with AI helping you along the way.
You work closely with development and DevOps teams to integrate security into fast-paced workflows. In your experience, where does the biggest gap still exist between the people who build applications and the people who test their security? How can that gap be reduced without slowing down innovation?
The biggest gap is communication. Pentesting is often treated as just another mandatory compliance checkbox, and teams can be hesitant about findings - sometimes to the point of not wanting to help, or even making it harder to uncover issues. I understand where that fear comes from, but it's important to remember that pentesters work under contract, within a limited timeframe, and are there to help fix what they find afterward. Real attackers, on the other hand, can spend months going after your systems with no time constraints at all. So it's crucial to understand that we're not the enemy - we're a way to strengthen your own security. The more a team cooperates with that process, the better off they'll be in the end.
Beyond your day-to-day work, you are also involved in the cybersecurity community as an AWS User Group Leader, Community Builder, meetup speaker, and CTF player. How important has the community been in your own development as a security professional, and what role do events like DefCamp play in that process?
Growing the community matters enormously. For many junior and even experienced specialists, it often teaches more than university programs or formal courses ever could. You get to meet people, exchange ideas, and that pushes technologies and approaches forward even further – all in a friendly, open atmosphere.
Even though I'm actually quite shy by nature, I'm still very motivated to speak at events like this, and DefCamp is my favorite, because it brings together some of the sharpest specialists and the best insider knowledge in the field.
It’s not a one-way street either – I don’t just share my own experience, I walk away having learned a ton myself. That exchange is exactly why community events like DefCamp matter so much: they compress years of scattered learning into conversations you can have in a single hallway.
For students or junior professionals attending DefCamp who may be curious about mobile or application security, what would you encourage them to start experimenting with first, and what do you wish someone had told you when you were beginning your own cybersecurity journey?
Start hands-on, as early as possible. Set up a simple lab – an emulator or a rooted/jailbroken test device, a proxy tool like Burp Suite or mitmproxy, and Frida – and just start intercepting traffic from a deliberately vulnerable app or your own test build. You’ll learn more from a few hours of poking at a real app than from weeks of reading theory alone. The OWASP MASTG and MASVS are a great free foundation for structuring what you’re learning, and mobile-focused CTF challenges are a fun, low-stakes way to build muscle memory for the tools and techniques you’ll use on the job.
What I wish someone had told me at the start: you don’t need to know everything before you begin, and you’re not supposed to. Security is a field where the target keeps moving, so feeling behind is normal, not a sign you don’t belong. Don’t be afraid to break things, get stuck, and ask “dumb” questions – that’s literally the job. And find your community early: a mentor, a meetup, a Discord full of people testing the same kinds of apps. It will save you months of struggling alone with problems someone nearby has probably already solved.” she added.
Security isn’t built on default assumptions, it’s built on curiosity, constant verification and breaking things until the real gaps show up. Victoria’s deep dive into Flutter is proof that understanding compiled logic is no longer optional for modern mobile defense.
As Victoria put it, some of the most valuable security lessons don’t come from documentation, but from conversations in a single hallway. As the region’s premier cybersecurity conference, DefCamp 2026 continues to be the ultimate meeting ground where groundbreaking technical research meets real-world application. Catch Victoria Shutenko live on stage, bring your hardest questions and join the community pushing mobile security forward.
Meet the interview author:
Eugenia Vacarciuc is a student at Politehnica University of Bucharest, passionate about mobile application development, offensive security and secure architecture. Driven by curiosity and hands-on experimentation, she constantly deepens her knowledge in the cybersecurity landscape.
