6 December 2025 · 4 min read
Secrets in the binary
API keys and credentials compiled into the app are extractable in minutes. Anything in the binary is public.
Move privileged operations server-side. The client should never hold a key that grants more than the user's own access.
Insecure local storage
Tokens and personal data in plain preferences or unencrypted files are readable on a rooted device.
Use the platform keystore for credentials and encrypt sensitive local data.
Weak transport validation
Disabled certificate validation in a debug build shipping to production is a recurring finding.
Enforce TLS validation, and verify it in the release build rather than assuming.
Over-permissioned APIs
Server endpoints that trust client-supplied identifiers without authorisation checks are the most common serious finding.
Authorise every request server-side against the authenticated user, on every endpoint.
Where to go from here
If you are weighing a mobile security review for an upcoming project, the useful next step is usually a short scoping conversation rather than a longer article. Bring your constraints — budget, timeline, existing systems, and the team you already have — and the decision usually resolves itself in an hour.
We run these as a fixed-scope discovery session with a written recommendation at the end, including the cases where our advice is that you do not need us.
Working on something like this?
Send us the brief. We will tell you what we would build, what we would cut, and roughly what it costs.
Talk to us