Mobile apps
5 guides tagged Mobile apps, grouped by topic, with the SDLC phase and role each is written for.
- SDLC phases
Application security
5 guidesReview trust boundaries in mobile and native clients
Protect local data and platform interactions while keeping server-side authorization independent of the client’s behavior.
Design, Development · Developers, AppSec engineers
Review mobile storage, links and platform permissions
Keep local artifacts and platform entry points from exposing authority that belongs on the server.
Design, Development · Developers
Harden an Android app's storage, network and entry points
Encrypt local secrets with Android Keystore keys now that Jetpack Security is deprecated, set transport policy in Network Security Configuration, close exported components and mutable PendingIntents, confine WebViews, verify App Links and judge Play Integrity verdicts on the server, mapped to OWASP MASVS 2.1.
Development · Developers, AppSec engineers
Harden an iOS app's storage, network and entry points
Store secrets in the Keychain with the narrowest accessibility class, set file protection explicitly, keep App Transport Security on, prefer universal links, constrain WKWebView bridges, keep step-up keys in the Secure Enclave, verify App Attest on the server and ship an accurate privacy manifest, mapped to OWASP MASVS 2.1.
Development · Developers, AppSec engineers
Worked threat model: a mobile banking app
A complete worked threat model for a mobile banking-style app: the data-flow diagram and its elements, STRIDE threats on the client, the transport and the backend, and the mitigations mapped to OWASP MASVS v2 controls and current Android and iOS platform APIs.
Design · AppSec engineers