Flutter CTO Report by LeanCode

When LeanCode first told me of their intentions to run an independent Flutter survey, I felt tremendous gratitude around our community’s generosity and collaborative spirit.

From the hosts of HumpDay Q&A to our countless open source contributors to now LeanCode’s survey, Google has long known that we could never accomplish all of our goals without our community. And so first and foremost, I want to thank the team at LeanCode for conceiving, designing, and executing this survey all on their own.

The Flutter team was certainly happy to assist them spread the word, but the survey’s true value came from its independence. Of course, this is an attribute my colleagues within Google’s walls are incapable of achieving, so initiatives like this are uniquely helpful.

I went into the results with an open mind, and as you’ll see below, came out heartened - Flutter’s road map is well aligned with what this survey suggests our developers want out of the framework. Of course, finite staff means not all items on the community’s collective wish list are currently receiving Google’s attention, but the Flutter team has already been hard at work on many of these topics for months.

One interesting result was Kotlin’s strong position as Flutter developers’ second favorite language. This is unsurprising for multiple reasons, including Kotlin’s obvious strengths and position within the Android ecosystem; but it suggests that Dart was wise to take inspiration from Kotlin when pursuing new language features. Null-safety, records, and pattern matching were all differentiators for Kotlin that the Dart core language team worked very hard to incorporate. It’s clear to me that this work delivered direct value to our ecosystem.

Another interesting result was that most new Flutter developers arrive not from other cross-platform frameworks, but from native development. When teams want to expand the reach of their established apps by adding more build targets, cross-platform frameworks make it possible to avoid multiplying their size, budget, and number of headaches. Flutter believes deeply that every great iOS app should be available on Android, and every great Android app should be available on iOS. Users around the world should all enjoy the best software experiences possible; as both developers and users.

Relatedly, 64.4% of teams distributing their software as web apps tells me that the colossal task of porting a once mobile-first framework to the web has succeeded. Admittedly, Flutter’s early Web days were humble - but the tripling of positive sentiment between the previous 3 years and next 2 years is a great signal. Three out of the four most anticipated upcoming features (SEO, hot reload in JavaScript, and WasmGC) being web-related also suggests serious demand for high quality, uncompromising web apps written in Flutter. And that’s great news, because the Flutter team has been working on all three for most of 2024!

The survey’s Net Promoter Score of 73 and the fact that 95.7% of respondents would choose Flutter again reflect a strong vote of confidence and matches data we’ve seen elsewhere that suggests professional experience with Flutter more than triples a developer’s probability of recommending the framework. This motivates us to keep innovating and supporting our developers to achieve even greater heights.

Despite the positive feedback, the survey also sheds light on some key areas where we can do better. Concerns about the discontinuation of product support, limitations with Web implementation, and challenges with hiring skilled Flutter developers stand out. The Flutter team is committed to working with the developer community to address these issues on an ongoing basis.

Flutter’s future depends on continued alignment between our goals and your wishes, so please know that responding to surveys is its own form of contribution. Flutter’s quarterly survey is our primary source of community sentiment, but LeanCode’s Flutter CTO survey added a fresh vantage point of where and how Flutter can improve. I would like to thank LeanCode for their diligent work in conducting this survey and to all of you CTOs and developers who participated. Now, let’s get back to work!

Flutter launched in 2018 with a bold promise: code once, run anywhere. This cross-platform vision was alluring, yet met with skepticism. Five and a half years later, the Flutter community has matured significantly. To understand the current state of affairs, we conducted a comprehensive survey, engaging nearly 300 CTOs, CIOs, and Tech Leads.

This report, based on real-world data, provides crucial insights to help you make informed decisions about incorporating Flutter into your technology stack.

What’s the verdict?

Is Flutter a good choice? With an NPS score of 73, the vast majority of respondents would enthusiastically recommend Flutter to their peers. Moreover, a staggering 95.5% of respondents would choose Flutter again when looking back on their experiences.

The speed advantage is significant.

Flutter’s advantages when it comes to development speed are undeniable. Over 56.4% of respondents reported a more than 50% increase in development speed compared to native approaches, with over 80% citing a minimum 20% improvement. These time and cost savings are simply too significant to ignore.

Is Flutter the ultimate solution?

Does it mean that you should close your eyes and choose Flutter no matter what? Absolutely not. This universe still has its points of friction, which are clearly highlighted by our respondents. Make sure you undertake your evaluation carefully.

Don’t just take our word for it: listen to the experts.

While Flutter boasts numerous strengths, it’s important to acknowledge the existing challenges. We’ve addressed these concerns directly through interviews with leading voices in the Flutter community.

• Craig Labenz: Tackling the persistent “Google will kill Flutter” narrative.
• Kevin Moore: Examining Flutter’s readiness for building web applications.
• Eric Seidel: Exploring the friction points within the Flutter ecosystem.
• Ander Dobo: Delving into the package ecosystem and contributions to the framework.

A community-driven effort.

This report is a testament to the strength and collaborative spirit of the Flutter community. This initiative was completely independent, with no financial support or input from Google. We are incredibly grateful to the partners who believed in our vision and supported this project: Widgetbook, Codemagic, Talsec, Shorebird, Serverpod, Devangels, Fluttercon, Flutter&Friends, Full Stack Flutter, Flutter Warsaw, Flutter Vienna, Flutter Hamburg, Flutter Berlin and Flutter Stockholm.

Thank you to our participants.

This report would not exist without the dedication of our participants. You, our valued respondents, generously devoted an average of 19 minutes of your valuable time to share your insights. On behalf of the entire LeanCode team, thank you for your contribution.

Now it’s your turn!

Dear Reader, now it’s your time to decide whether to join the Flutter universe and this great community. Years ago, I would have called that a brave decision. Today, with our report, you can make a data-driven decision. You’re welcome.

Flutter is becoming a default cross-platform technology.

Is Flutter still just a niche technology? That was the question echoing over the last couple of years among decision-makers who were scared to choose the stack, which can be exotic and cause maintenance problems. While it is clear that building two almost identical apps separately for both platforms makes no sense, it wasn’t clear which cross-platform framework to choose.

The entry level for new technology such as Flutter was also very high, with React Native being a strong candidate to solve the cross-platform challenge.

Yet, over time, due to developers’ great experience (stateful hot reload, excellent tooling, stable package, etc.), experts tend to gravitate towards Flutter, which is reflected by a renowned vanity metric: stars on GitHub.

The better developer experience is also reflected in the Flutter CTO Report, where 98% of CTOs gave positive feedback on Flutter, and 37.4% disliked React Native.

Enterprise companies using Flutter.

This coincided with the arrival of great case studies from experienced teams working on large-scale apps, which ignited the belief that everything is possible with Flutter. The abundant evidence coming from teams like Credit Agricole, BMW, Virgin, Tide, Philips, Tencent, Betterment, Toyota, and iRobot was really eye-opening. It proved that not only are large-scale apps achievable with Flutter but also that they are performant and bulletproof when it comes to security and penetration tests.

Companies are increasingly betting on Flutter.

Since Google I/O 2024, we have witnessed even more examples of companies using Flutter. LG confirmed its plans to shift the Flutter-based applications to tens of millions of users, Universal Studios presented their new systems built with Flutter to visitors of their amusement parks, and GEICO selected Flutter as the framework for optimizing and innovating digital experiences across multiple channels.

How does Google use Flutter?

What is more, Google itself is also making significant investments in building the Flutter teams internally, which ship new products. This portfolio of internal applications includes Google Pay, Google Earth, Google Ads, Google Classroom, YouTube Create, Google Cloud, Google One, Family Link, Crowd Source, Google Analytics, and many others.

Our survey also reflects this trend. From the Flutter CTO Report, we can see that size doesn’t matter. While Flutter remains powerful for PoC and MVPs, it is also widely adopted by larger teams, as almost 40% of Flutter teams have 6 or more Flutter Devs. What is more, according to the Flutter CTO Report, 13% of Flutter apps have an audience of 1M users and above.

Not surprisingly, Flutter is also becoming a default solution for large-scale apps. In our report, a dominant 85% consider Flutter suitable for large-scale projects, in comparison to 71.2% for the past 3 years.

Last but not least, there is no longer a problem with the shortage of developers on the market. Over the years, while Flutter was becoming more and more popular, we could observe that a substantial share of experts gained sufficient expertise to lead complex projects in Flutter. Therefore, new developers are more willing to migrate from both native Android (an increase from 42.3% to 51.9%) and iOS (an increase from 24.2% to 35.5%) ecosystems.

What else is worth noting and what the Report clearly shows is that Flutter’s capabilities are not limited to mobile applications. We can see that 64.4% of projects are using Flutter for Web implementation, which proves that the recent announcements regarding WASM stability are definitely a step in the right direction.

All in all, we see massive evidence supporting the claim that Flutter is a widely adopted, crossplatform framework, which is becoming a default solution for achieving the goal of targeting different interfaces from one codebase.

Dart, originally created by Google for building complex, high-performance web applications, has increasingly found its niche primarily in mobile development. Known for its simplicity, strong typing, and native performance, Dart is beloved by programmers for its speed and ease of use. Its seamless integration with Flutter has revolutionized mobile app development, but Dart’s capabilities extend far beyond the frontend.

Dart on the server

Dart’s entrance into the backend development brings a host of benefits. Its strong typing and ahead-of-time compilation leads to fast execution and low latency, which are essential for high-performance backend applications. Dart’s concurrency model, based on asynchronous programming, makes it highly efficient at handling multiple simultaneous connections, a key requirement for modern server applications.

Moreover, using Dart for both frontend and backend development offers a unified language experience. This reduces the cognitive load on developers, who no longer need to switch contexts between different programming languages. It also streamlines the development process, allowing for a more consistent and maintainable codebase. In addition, developers can share code between frontend and backend.

Introducing Serverpod

Serverpod is a standout framework designed specifically to leverage Dart’s strengths for backend development. As an open-source, scalable app server, Serverpod provides a seamless bridge for Flutter developers to extend their applications into the backend. Its design focuses on making backend development as straightforward and efficient as possible, ensuring that developers can quickly become productive without a steep learning curve.

Serverpod offers a rich set of features that cater to the needs of modern backend development. It simplifies the creation of server endpoints and automates the generation of protocol and client-side code. This automation minimizes the potential for errors and allows developers to focus on writing business logic instead of boilerplate code.

The forthcoming release of Serverpod Cloud this fall is particularly noteworthy. This new service will simplify the deployment and management of Dart servers, allowing developers to deploy Serverpods with minimal effort and infrastructure management.

The competitive landscape

In the Dart backend ecosystem, Serverpod faces competition from frameworks like Dart Frog and newcomers such as Celest. Dart Frog is appreciated for its simplicity and quick setup, making it suitable for smaller projects or those needing a lightweight solution. Celest, although new, is gaining traction with its innovative features and active development community.

Conclusion

Dart’s potential on the backend is being realized through frameworks like Serverpod. By providing a powerful, easy-to-use backend solution tailored for Dart and Flutter developers, Serverpod makes it possible to harness the full capabilities of Dart across the entire development stack.

Note: What is Serverpod?

Serverpod is an open-source, scalable app server written in Dart for the Flutter community. It features automatic generation of protocol and client-side code, making remote endpoint calls as easy as local method calls. Additionally, Serverpod includes a revolutionary ORM that uses native Dart types.

In the rapidly evolving landscape of mobile app development, choosing the right tools can significantly impact your team’s productivity, efficiency, and code quality. For development teams leveraging Flutter, Codemagic offers a premier CI/CD (Continuous Integration/ Continuous Deployment) solution designed to streamline workflows, accelerate build processes, and ensure high-quality app releases.

Continuous integration

Every time a developer checks in new code, Codemagic starts a new build to ensure the application compiles correctly and no new bugs or issues are introduced. This immediate feedback loop is crucial in maintaining the integrity and quality of your application, preventing potential problems from reaching production. Additionally, Codemagic allows for the integration of static code analysis, unit tests, and comprehensive integration and end-to-end tests into your CI workflows, providing thorough quality coverage and further enhancing app reliability.

Continuous deployment

Codemagic simplifies the code signing and deployment process, allowing you to easily distribute your app to developers, testers, and stakeholders or directly to the App Store, Google Play, or other app stores. Your app builds can also be distributed using shareable build dashboards, and build notifications can be sent via email or Slack. This flexibility ensures that your app reaches the right hands promptly, facilitating faster feedback and more efficient iterations.

Why Flutter development teams choose Codemagic

Codemagic has established itself as the go-to CI/CD tool for Flutter development teams, and several factors contribute to its popularity and effectiveness. Launched in collaboration with Google during the official release of Flutter 1.0 in 2018, Codemagic has deep roots in the Flutter ecosystem. This long-standing relationship with Flutter ensures that Codemagic stays ahead in supporting the latest Flutter updates and features. Today, thousands of development teams rely on Codemagic to build, test, and publish their Flutter apps.

Fast build infrastructure

Codemagic offers a well-maintained and fast-build infrastructure, utilizing cutting-edge hardware such as Apple Silicon M2 machines to reduce build times. If you plan to build for other platforms, Windows and Linux machines are also available.

Timely software updates

Staying current with the latest development tools is crucial. Codemagic ensures that Xcode versions are made available within days of their release, including beta versions, keeping your development environment up-to-date and compatible with the latest advancements.

Extensive integration capabilities

Codemagic integrates seamlessly with numerous third-party services, enhancing its utility and flexibility. From real device testing and code testing services to project management solutions and code obfuscation tools, Codemagic provides comprehensive support to cover all aspects of your development workflow.

Support and community

Codemagic understands the importance of support and community and offers multiple support channels, including a Discord community, in-app chat support, GitHub Discussions, extensive documentation, and a repository of GitHub samples. These resources ensure that you have access to the assistance and knowledge you need to overcome any development challenges.

Transparent and flexible pricing

Codemagic’s pricing model is designed to be both transparent and flexible, catering to teams of all sizes and requirements. Their pay-as-you-go (PAYG) plan allows you to pay for the minutes you use, while their fixed plan offers unlimited build minutes with a specified number of parallel builds, which can be increased as your needs grow. Additional benefits include unlimited apps, unlimited team seats, standard support, and specialized plans for Enterprise teams, which feature SSO login, service level agreements, security compliance, signed NDAs, and priority support.

Conclusion

For CTOs and senior engineers considering Flutter as their development framework, Codemagic offers an unparalleled CI/CD solution that enhances productivity, ensures high code quality, and simplifies deployment processes. With its expert support, fast-build infrastructure, regular updates, extensive integrations, and flexible pricing, Codemagic stands out as a great choice for Flutter development teams. Embrace Codemagic to unlock the full potential of your Flutter projects and drive your development efforts to new heights.

See Codemagic Documentation

NOTE: What is Codemagic?

Codemagic CI/CD is for mobile dev teams building Flutter apps. Build, test, and deploy your apps using fast Apple M2 machines. Integrate with third-party tools to monitor code quality, run tests, or update your project system. Pay for minutes used or get unlimited build minutes with an annual plan.

About LeanCode

LeanCode, a Warsaw-based software house, specializes in mobile and web application development with a strong focus on Flutter

The challenge

LeanCode aimed to set up a robust design system and component library. This was crucial for maintaining consistency and efficiency in their development process. Furthermore, they needed an effective way to share these components with a broader audience, including quality assurance teams and designers, for feedback. Initially, they managed this by deploying Widgetbook themselves, but as the number of branches increased, this approach became cumbersome. LeanCode required a more streamlined solution to make their UI components easily accessible to everyone involved.

The solution

LeanCode adopted Widgetbook to address their challenges. Widgetbook’s open-source package enables developers to catalog widgets in a central library and test them across various devices and themes. Widgetbook Cloud extends this by providing seamless hosting and management of multiple Widgetbook instances, greatly simplifying the workflow. Its automatic detection of visual bugs in pull requests allows LeanCode to swiftly review all UI changes in their Flutter apps. Additionally, Widgetbook Cloud supports LeanCode to keep its Figma files synchronized with the codebase. This integration significantly enhanced LeanCode’s quality assurance process by making component previews easily accessible to all team members.

New workflow

With Widgetbook Cloud, LeanCode introduced a more efficient workflow:

• Integration: Each new project includes a Widgetbook setup with a dedicated instance of their design system.
• Live Documentation: Clients now have access to live documentation of all design system components without additional maintenance or cost.
• Quality Assurance: Strict client requirements for quality and component testing are met through Widgetbook Cloud. LeanCode deploys to the Cloud on every design system change, requiring a designer’s check as part of their pull request approval policy.

Key features utilized

LeanCode leverages several Widgetbook features:

• Environment Testing: Addons for checking components against different locales, themes, and accessibility settings.
• Branch Deployment: Deployment of main and feature branches, all accessible simultaneously in the Cloud.
• Review Feature: Enhanced cooperation with QA participants through the review feature.
• Golden Test Approach: Ongoing evolution of the review process with a focus on golden test-like methods.

Value derived

Widgetbook Cloud has helped to streamline LeanCode’s UI development and review processes. The platform lets LeanCode’s developers focus on their tasks and quickly identify shortcomings. The integration provides easy access for all stakeholders, enhancing collaboration and efficiency

LeanCode’s senior staff quantified their time savings of several weeks of development time.

At Widgetbook, we are grateful for having such a positive impact on LeanCode’s exceptional mobile development and for this excellent cooperation.

NOTE: What is Widgetbook?

Review all UI changes of your Flutter app with Widgetbook. Our open-source package allows you to catalog widgets in one design system and test them quickly in all use cases. Widgetbook Cloud automatically catches visual bugs in your pull request and syncs your Flutter widgets with Figma.

Flutter has gained significant traction within FinTech, underscoring the crucial need for robust security measures. The platform’s popularity attracts attention from both app developers and cybercriminals. Flutter’s strong security posture, evidenced by fewer reported vulnerabilities and CVEs, makes it a solid choice for developing sensitive apps.

Flutter Built-in Security

Flutter is more resilient to decompilation than native apps. Its binary packaging offers better protection of code and hardcoded data, although the number of Flutter-specific reverse engineering tools is increasing rapidly, continually broadening the potential threat landscape (e.g., reFlutter, flutter-spy, blutter).

Common Vulnerabilities

Despite its advantages, Flutter apps are not immune to common vulnerabilities:

• Privileged Access Issues: Rooting and jailbreak concerns remain prevalent.
• Dynamic Attacks: Techniques such as hooking frameworks (e.g., Frida, Xposed) pose significant risks.
• App Cloning and Repackaging: Unauthorized duplication of apps is a persistent threat.
• TLS Pinning Bypass: Critical for defending against man-in-the-middle attacks.
• Session Hijacking and App Impersonation: Compromise user sessions and mimic legitimate apps.
• Malware: Leveraging app permissions (accessibility misuse, screen sharing, keyloggers, SMS OTP interceptors, etc.) for malicious activities.

Developer Awareness

Flutter developers must stay informed about security threats and evolving attack vectors across all supported platforms. This demands n-depth expertise and continuous learning, making app security a specialized area within software development.

Essential Security Hardening Measures

In the financial sector, regulators mandate the adoption of a range of security techniques, which can be categorized into three primary areas:

1. Runtime Application Self-Protection (RASP): Implement client-side measures to monitor and react to integrity and environment compromises.
2. API Protection: Safeguard against app impersonation using tools like Firebase App Check, attestation services, or API protection SDKs such as AppiCrypt.
3. Anti-Malware: Detects and mitigates risks posed by malicious apps on client devices.

Basic controls can often be implemented using freemium or community-supported tools. However, advanced enterprise-grade protection typically requires custom development or commercial security solutions.

Advances in Mobile Security Tools for Flutter

The proliferation of app-to-API end-to-end protection solutions (such as App Attestation, AppiCrypt, and AppCheck) is effectively countering the escalating threats from mobileoriented API abuse. These threats encompass App impersonation techniques such as botnets, password enumeration scripts, data scraping, promotional abuse, fake registrations, and phishing campaigns

However, due to Flutter’s compiled nature, Static Application Security Testing (SAST) tools have not yet reached the level of sophistication seen in native applications. This presents a challenge in maintaining security parity with other platforms. Conversely, the advent of Software Bill of Materials (SBOM) analysis has simplified the examination of third-party dependencies, thus enhancing the thoroughness and effectiveness of security assessments.

Overall, while there are still areas needing improvement, the strides made in mobile security tools for Flutter demonstrate significant potential in safeguarding against complex and evolving threats.

Budget Considerations

App issuers should allocate 20% to 25% of development and maintenance budgets to security features. It’s crucial to recognize that due to the dynamic nature of attack vectors and operating system updates, ongoing maintenance costs for security features may be significantly higher than initially estimated.

Conclusion

Proactive security measures are not just beneficial but essential for app protection in today’s dynamic threat environment. Ensuring comprehensive security requires both strategic investment and dedicated expertise.

NOTE: What is Talsec?

Talsec is a community-driven mobile app security company. The core community product is freeRASP. The company is focusing on providing solutions for the Flutter community.