Mobile Application Security Testing
A mobile app ships your code onto devices you don't control, with a backend API exposed to anyone willing to inspect the traffic. I assess Android and iOS applications against the OWASP MASVS, combining static analysis of the binary with dynamic, on-device testing and a close look at the APIs the app depends on.
What this assessment covers
A focused, manual-led engagement scoped to your environment. Every finding is validated and documented with clear remediation guidance.
- Android application security
- iOS application security
- Static & dynamic analysis
- Insecure data storage
- Certificate pinning assessment
- Mobile API communication testing
Static Analysis
- Binary, manifest & permission review
- Hardcoded secrets & keys
- Insecure coding patterns
Dynamic Analysis
- Runtime manipulation & hooking
- Insecure data storage at rest
- Logging & inter-process leakage
Transport & Trust
- TLS configuration review
- Certificate pinning & bypass
- WebView & deep-link handling
Backend
- Mobile API authentication & authorization
- Session & token handling
- Server-side input validation
What you get out of it
The point of a test isn't a long list of issues — it's a clearer, safer, more defensible product.
Protect data on the device
Local storage, caches, logs, and keychains are reviewed to ensure sensitive data is never left unprotected at rest.
Secure the app-to-server channel
Transport security and certificate pinning are tested to prevent interception and tampering of API traffic.
Cover the full stack
The backend APIs that power the app are assessed alongside the client, closing gaps that client-only tests miss.
Common questions
Do you test both Android and iOS?
Yes, individually or together. Pricing and scope reflect the platforms and the number of builds in scope.
What do you need to begin?
The application build (APK/IPA or a test-track invite), test accounts, and any relevant API documentation.
Do you handle jailbroken/rooted testing?
Dynamic testing typically uses a rooted/jailbroken device or emulator in a controlled environment to observe runtime behaviour.