Static analysis
The binary is decompiled and reviewed for hardcoded credentials, API keys, cryptographic material, debug endpoints, and logic that assumes the client cannot be modified.
Mobile application penetration testing
A mobile app ships your client-side logic to the attacker's device. We reverse it, instrument it at runtime, and then test the backend it talks to — because that is where the data actually lives.
Scope
What we actually test
Android and iOS, tested statically and at runtime on real or emulated devices.
Data at rest
Shared preferences, SQLite and Realm databases, keychain and keystore usage, cache and log files, backup inclusion, and what survives an uninstall.
Transport security
TLS configuration, certificate and public-key pinning, and whether pinning can be removed at runtime to expose the traffic underneath.
Runtime manipulation
Hooking with Frida and Objection to bypass root and jailbreak detection, defeat client-side authorisation, and reach code paths the UI does not offer.
Platform surface
Exported activities, services, content providers and broadcast receivers on Android; URL schemes, universal links and pasteboard handling on iOS.
The backend
The API behind the app, tested with the same rigour as a standalone API engagement — because a hardened app in front of a broken API is not a secure product.
Every engagement ships with
- Executive summary written for leadership
- Technical report with reproducible proof-of-concept for every finding
- CVSS v3.1 vectors and a plain-English business-impact narrative
- Prioritised, concrete remediation guidance
- Same-day alerting on anything critical
- Live debrief with your engineering team
- Free retest of every finding within 90 days
- Signed attestation letter for auditors and customers
FAQ
Questions about this service
Do you need the source code?
No. We work from the compiled build you would ship to a store. If you do provide source, we use it to trace findings back to the exact line, which shortens your fix cycle considerably.
Do you test both Android and iOS?
Yes. They are scoped separately because the platforms fail differently, but they are usually run together and reported as one engagement.
What do you need from us?
A build (APK/AAB or IPA), test accounts for each role, and any backend endpoints in scope. For iOS, either a build we can install directly or TestFlight access.
Do you test against MASVS?
Yes — OWASP MASVS is the baseline, and findings are mapped to it. We then go beyond it, because a control checklist does not chain vulnerabilities together the way an attacker does.
Next step
Find out what an attacker would find.
Tell us what you have built. You get a reply within one business day, an NDA, and a free 30-minute scoping call with the person who will do the testing.