Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
What's inside?
Two checklists in one, across 15 device and infrastructure types:
The verification checklist - eight requirement blocks: architecture and threat modeling, data storage and privacy, cryptography, authentication and sessions, network communication, platform interaction, code quality and build settings, and resiliency against reverse engineering.
The pentest checklists - one for Android and one for iOS, covering information gathering, IPC security, WebView attacks, TLS pinning bypasses, sandbox escapes, authentication flaws, and code-signing weaknesses.
The tool stack - APKTool, Frida, MobSF, Cydia Substrate, Cycript, Burp, and the security libraries (ProGuard, SQLCipher, RootBeer, iMAS) worth shipping with your app.
What you’ll learn
By the end, you'll be able to:
Design a mobile app that's secure by architecture, including a real threat model for both the app and its backend.
Store sensitive data the right way, using system credential stores instead of local files, and wipe memory after use.
Configure TLS, cert pinning, and network calls so a rooted device with Burp installed can't quietly proxy your traffic.
Run Android and iOS pentests separately, because they fail differently, and treating them the same misses on both sides.
Bypass your own root detection and SSL pinning to see what a real attacker would find.
Both stores get their own pentest checklist here for a reason. A mobile audit that treats Android and iOS as one platform is bound to miss most of the bugs.
Who’s this for?
Read this if you're a…
Mobile engineer shipping to both stores and want a checklist that covers both, not just yours.
Mobile security lead scoping a pentest and want it to include Frida, WebView abuse, and cert pinning bypass, not just static analysis.
CTO at a company where the app is the product and a breach means a churn event.
