Mobile security
What this covers
These posts cover Android and iOS application security as it appears in real assessments: what ships inside the package, what lands on the device, how transport protections are bypassed, and why the backing API is usually where the severe findings actually are.
Mobile assessments keep surfacing the same four problems: secrets compiled into the binary, long-lived tokens written to unencrypted storage, transport protections that fail open, and an API that trusts whatever the app sends it. These posts work through each in the order an attacker meets them.
4 posts in Mobile security.
Mobile security · 4 min read
Twenty checks, grouped the way an attacker looks at an app: what ships inside the package, what lands on the device, what crosses the network, and what the server accepts.
Mobile security · 4 min read
The Top 10 is written platform-agnostically. Here is what each risk looks like in a real Flutter project, and which package choice usually causes it.
Mobile security · 4 min read
Pinning fails in one of two ways: not implemented, or implemented so tightly that a routine certificate renewal takes the app offline for everyone who has not updated.
Mobile security · 3 min read
A mobile scanner report reads alarmingly and usually contains nothing severe. Everything severe requires a second account, a device and a person.
Scope and a fixed quote within two working days. First consultation is free.