Mobile Application Security Blog

Researchers watched the traffic of 444 iPhone AI apps and found 282 leaking API keys, replayable tokens or open backends. The AI part is new. The mistake, a secret shipped inside the app, is as old as mobile. Here is the list I run against our own builds.

A new banking trojan, Rokarolla, hits 217 banking and crypto apps with screen overlays, accessibility abuse and OTP theft. Most of its moves target the phone around your app, not a bug inside it. Here is what to check in your own build.

The same finding categories come back first in almost every Android and iOS scan. Here is what each one means in engineering terms, why it ranks high, and the fix that actually closes it.

What mobile application security really means, where Android and iOS apps get attacked, the risks worth knowing, and how teams test an app before they ship it.

Hardcoded keys and tokens are easy to leave in an app and easy for an attacker to pull out. Here is where they hide in an Android build and how to find them before release.

Most mobile security problems are avoidable with a short, consistent check before release. Here is a practical checklist you can run on every Android and iOS build.

You do not need the source code to test an Android app. The shipped APK is the same file an attacker has. Here is how to work from it, step by step.

Static, dynamic and runtime testing each see a different part of an app. Here is what SAST, DAST and IAST catch, and when to use each one.

Certificate pinning makes an app trust only specific servers, which resists traffic interception. Here is how it works, where it breaks, and how to test it.

Firebase is everywhere in mobile apps, and a weak rule or open bucket can expose a whole user base. Here is how Firebase misconfiguration happens and how to find it.

Permissions decide what an app can reach on a device. Asking for more than you need widens the attack surface and worries users. Here is what to know.

Insecure on-device storage is one of the top mobile risks. Here is what not to do, where sensitive data belongs, and how to check your storage is safe.