Mobile app security

Mobile app security assessments for iOS and Android.

A mobile app ships your code, your keys, and your API contract to every attacker's phone. We test the app and the backend it talks to, cover the OWASP Mobile Top 10, and align our verification with OWASP MASVS. Manual, senior-led, fixed price, remediation retest included.

Scope a mobile assessment What we need from you
Platforms

iOS, Android, or both

Each platform fails in its own ways. We test them separately, even when they share a codebase.

iOS

Keychain and file storage, App Transport Security, URL schemes and universal links, WebViews, entitlements, and jailbreak detection.

Swift · Objective-C · React Native · Flutter

Android

Exported activities, services, and content providers, intents and deep links, Keystore use, network security config, WebViews, and root detection.

Kotlin · Java · React Native · Flutter
Coverage

OWASP Mobile Top 10, and past it

The Top 10 is the floor, not the scope. Every assessment covers it, and we keep going where your app's design takes us.

OWASP Mobile Top 10 (2024)
  • M1 Improper Credential Usage
  • M2 Inadequate Supply Chain Security
  • M3 Insecure Authentication/Authorization
  • M4 Insufficient Input/Output Validation
  • M5 Insecure Communication
  • M6 Inadequate Privacy Controls
  • M7 Insufficient Binary Protections
  • M8 Security Misconfiguration
  • M9 Insecure Data Storage
  • M10 Insufficient Cryptography
Aligned with OWASP MASVS

We structure testing and reporting around the MASVS control groups, so findings map to a standard your team and your customers recognize.

  • STORAGE sensitive data at rest
  • CRYPTO key handling and algorithms
  • AUTH authentication and session
  • NETWORK transport security and pinning
  • PLATFORM IPC, WebViews, deep links
  • CODE dependencies and input handling
  • RESILIENCE tampering and reverse engineering
  • PRIVACY data collection and exposure
App and backend

The app is the front door. The API is the house.

Most serious mobile findings aren't in the binary. They're in the API the app calls: endpoints that trust the client, object IDs you can swap, admin routes the app never shows but the server still serves. We pull the API surface out of the app, then test it directly with authenticated accounts at each role.

Testing the app without its backend leaves the most likely path to your data untested. We scope both together.

01
Static analysis

Decompile and review the build for secrets, endpoints, and weak crypto.

02
Dynamic testing

Instrument the running app, intercept traffic, and bypass client-side controls.

03
API testing

Authorization, tenant isolation, and business logic on every endpoint the app uses.

Deliverables

What you get

The report
  • Executive summary for leadership and customer security reviews
  • Per-platform findings mapped to OWASP Mobile Top 10 and MASVS
  • Severity, evidence, reproduction steps, and real-world impact for each finding
  • Remediation guidance specific to iOS, Android, and your API
Remediation retest

Ship a fixed build and we retest it. Retests are included within 90 days of report delivery, and the final report is updated to show which findings are closed.

Scoping

What we need to scope it

Rough answers are fine. We'll come back with a scope, a timeline, and a fixed price.

  • Platforms. iOS, Android, or both, and whether they're native or cross-platform (React Native, Flutter, other).
  • Builds. An IPA, APK, or AAB, or access through TestFlight, Firebase App Distribution, or the public stores.
  • Accounts. Test accounts at each user role, ideally across two separate tenants or organizations.
  • Backend. API base URLs, environment (staging or production), and any API docs you have.
  • Sensitive features. Payments, health data, messaging, location, or anything else that raises the stakes.
  • Client-side controls. Whether the app uses certificate pinning, jailbreak or root detection, or obfuscation, and whether you want those tested or switched off for a build.
  • Driver and date. Customer review, compliance, launch, or a proactive check, and when you need the report.
FAQ

Mobile assessment questions

Do you need our source code?
No. We can test from the compiled build, the same way an attacker would. Source access is optional, but it can help us confirm root causes faster and point your team to the exact fix.
Do you test the backend API too?
Yes. We test the APIs your app depends on as part of the assessment, because that's usually where the highest impact findings are. If you also have a web app on the same API, we can scope it in.
Is this just the OWASP Mobile Top 10?
No. The Top 10 is a baseline we always cover. We align verification with OWASP MASVS and follow the app's actual design, including business logic and authorization flaws that don't fit neatly into a category.
Our iOS and Android apps share a codebase. Do we need both tested?
Usually, yes. Shared code doesn't mean shared risk. Storage, IPC, deep links, and platform permissions behave differently on each OS. Because the backend is shared, testing both is often less than double the effort, and we'll scope it that way.
Will testing affect our production users?
We prefer a staging backend for anything that writes data. If production is the only option, we agree on test accounts, windows, and anything off limits before we start.
Can the report support a customer security review or compliance audit?
Yes, that's a common reason teams engage us. The report states scope, dates, and methodology, and the retest shows what you fixed. How a reviewer or auditor weighs it is up to them. If SOC 2 is the driver, see SOC 2 penetration testing.

Find out what an attacker sees in your app.

Tell us about your app and your backend. We'll come back with a scope, a timeline, and a fixed price.

Email info@mavericksecurity.ai Scope it yourself first