Where mobile apps leak.
Secrets left on the phone
Tokens, keys and personal data stored where anyone holding the device can read them.
APIs that trust the app
Back ends that assume every request comes from your app, and hand over other users’ data when it doesn’t.
Checks that only work on screen
Authentication and authorization the app enforces, and the server doesn’t.
How the job runs.
Take the app apart
A static review of the iOS and Android builds: what’s inside and what’s stored.
Watch it run
Dynamic testing while the app runs, including everything it sends to your back end.
Attack the API
Every endpoint tested for broken access control.
Prove it and retest
Steps to repeat each finding, the fix, and a retest once it’s done.
When to call us.
- Before a release to the App Store or Google Play
- After API changes or new endpoints
- When the app handles payments or personal data
- For PCI DSS or SOC 2 evidence
On its own or all year?
Scoped as a job on its own, or added to a year-round plan. We agree it with you at the start.
Partners: A mobile test opens PCI DSS and SOC 2 conversations with clients that take payments in an app. Sell it under your brand.
Questions.
Do you need our source code?
No. We test the builds you ship. If you want to share source code, it helps us go deeper.
Do you test the back end as well?
Yes. Most of what goes wrong in a mobile app goes wrong in the API behind it, so it’s part of the job.
Check what the app gives away.
Tell us about the app and a technical account manager will scope the job with you.