Practical writing on mobile application security — OWASP MASVS in practice, reverse-engineering technique, and what we learn from the apps we scan.
A ride-sharing app shipped a Supabase anon key and left Row Level Security off one table. 26,686 trip records were readable by anyone who installed the app.
App Store encryption protects the Mach-O executable, not the React Native bundle beside it. Hermes bytecode isn't encryption either, and every string the app was compiled with is still in there.
One scan produced 116 findings. Eight rows described a single missing capability, and 93 of them landed in the tier everyone skips.
Scan an APK or IPA and get findings mapped to OWASP MASVS, with code-level remediation.
Start a free scan