Your app lives on thousands of phones you don’t control. These five habits prevent most of the mobile issues we find — tick off the ones you already have.
Your checklist
0/4Tick items off as you complete them.
Keep secrets off the device
Anything shipped inside an app can be extracted. Keep API keys and secrets on your servers and let the app talk to your backend instead of third-party services directly.
Store as little as possible
Avoid saving personal data, tokens or logs on the device. When you must, use the platform keystore and encrypted storage.
Protect the connection and the backend
Enforce TLS everywhere and secure the APIs behind the app — most serious mobile findings are really backend authorization problems. Test both together before each major release.
Habit four: keep third-party SDKs in check
Analytics, advertising and payment SDKs run inside your app with the same access it has. Review what each one collects, keep them updated, and remove the ones you no longer need.
Habit five: test before every major release
Mobile releases are hard to roll back once users update. A short security check before major releases catches issues while they are still easy to fix.
From our work · technical details
How we handle this in Mobile Application Pentesting
- Hardcoded API keys and secrets
- Sensitive data in local storage or logs
- Missing or bypassable certificate pinning
- Exported components open to other apps
- Weak root / jailbreak detection
- Insecure backend API authorization
How our team helps
- 01Run static and dynamic analysis on Android and iOS
- 02Test the backend APIs the app depends on
- 03Map results to OWASP MASVS
- 04Retest fixes before your release
- 05Review third-party SDKs in your app
- 06Test both Android and iOS builds
- 07Provide fixes your mobile developers can apply quickly
Planning a big release? Test before it hits the app stores, not after.
— The CRIS InfoTech security team