The Mobile App Security Checklist (2026)
104 controls for Android and iOS teams, mapped to OWASP MASVS v2 and the 2024 Mobile Top 10, with a how-to-verify tip for every item. Free PDF download.
checklistowasp-masvsguide
Resources
Guides, research and release notes
Practical writing on mobile application security — OWASP MASVS in practice, reverse-engineering technique, and what we learn from the apps we scan.
Four techniques, and what each one cannot see
Static analysis, dynamic analysis, network interception and runtime instrumentation each answer a different question about a mobile app - and each is blind in a different direction. What the core techniques actually find, and what to ask for in the report.
mobile-securityappsectestingmethodology
26,686 trips, no login required
A ride-sharing app shipped a Supabase anon key and left Row Level Security off one table. 26,686 trip records were readable by anyone who installed the app.
mobile-securitysupabaserow-level-securitydata-exposure
Encrypted on the App Store, readable in a terminal
App Store encryption protects the Mach-O executable, not the React Native bundle beside it. Hermes bytecode isn't encryption either, and every string the app was compiled with is still in there.
mobile-securityreact-nativestatic-analysis
What 116 findings look like when you have to triage them
One scan produced 116 findings. Eight rows described a single missing capability, and 93 of them landed in the tier everyone skips.
mobile-securitytriagefalse-positives
See what your own app is leaking
Scan an APK or IPA and get findings mapped to OWASP MASVS, with code-level remediation.
Start a free scan