A while back, a client asked me a deceptively simple question: "Can you find out how our competitor's mobile app talks to its backend?"

No public API docs. No Postman collection floating around GitHub. Just a Flutter app, a few permissions in the manifest, and a backend that clearly wasn't expecting anyone to come knocking.

I said yes before I...