We test iOS and Android apps on real devices: the app itself, what it stores on the phone, how it talks to your servers and the API it depends on.
The API usually matters most. An attacker can get around anything the app hides or checks on the device, so we also test the backend directly, as if the app weren't there. We follow the OWASP MASVS and MASTG.
We decompile the app and review its code and configuration for hard-coded secrets, insecure settings and risky third-party libraries.
We run the app on test devices, intercept its traffic and change its behaviour at runtime to see what an attacker with control of the device could do.
What the app leaves on the phone, such as databases, caches, logs and keychain or keystore entries, and whether any of it can be read when it shouldn't.
TLS configuration, certificate pinning where you use it, and whether any data leaves the device unprotected.
Login and session handling in the app, and the API behind it, tested directly for access control and input handling.
Root and jailbreak detection, obfuscation and integrity checks, where your threat model calls for them.
Each finding comes with the evidence behind it, a CVSS rating, the business impact and a concrete fix. Where it applies, that includes the requests and responses or the configuration details that show the problem. It's written so you can pass it to an engineer unchanged.
Two pages in plain language on the business impact and the priorities, written for your board or your customer's security team.
A working session with your engineers where we go through the findings, answer questions and agree how to prioritise the fixes. We can record it if you like.
No, we can test the compiled app. Source code does help: it lets us cover more in the same number of days, so we'll ask for it if you can share it.
The current release build of each app, and a debug build as well if the release build stops our testing tools from running. We'll tell you during scoping which ones we need.
Yes. Most apps share one backend API, so we test it once and spend the rest of the time on what differs between the two platforms.
Yes. A rooted or jailbroken device shows what an attacker who controls the phone could do. If your app is meant to refuse such devices, we check how well that holds up.
Book a scoping call, and we'll send you a fixed quote as soon as we've agreed what to test.