Blog

Practical articles on preparing for the expertise

What the expertise asks for, where mistakes are common and how to close them — from our own experience.

Deep links and exported components: the open doors of Android and iOS apps

Exported activities, services, receivers and providers, plus deep links, are ways into your app from outside. How to check them and close them.

27 October 2026 · 10 min read

Mobile

WebView security: JavaScript bridges, file access and clearing data on logout

A WebView is a browser inside your app, but without the browser's protections. How to configure JavaScript bridges, file access, mixed content and URL allowlists.

20 October 2026 · 10 min read

Mobile

Keys and API endpoints inside APK and IPA: why a "hidden" key is not a secret

Any key or endpoint shipped in a mobile app can be found with jadx or strings. What can stay in the app, what belongs only on the server, and where obfuscation stops helping.

13 October 2026 · 10 min read

Mobile

OWASP Mobile Top 10 (2024): M1 to M10 and what the security review checks in each

A walkthrough of the 2024 OWASP Mobile Top 10: what each category means, how the expert tests it, and how to prepare your app.

7 October 2026 · 12 min read

Mobile

Dynamic analysis (Frida) and emulator protection: what RASP is

Frida can change an app's functions while it runs. Security reviews rate this as high risk on both Android and iOS. What RASP is and how to implement it.

7 October 2026 · 7 min read

Mobile

Storing sensitive data securely in a mobile app: Keystore and Keychain

Keeping tokens and personal data in SharedPreferences or UserDefaults is rated high risk in a security review. How to use Android Keystore and iOS Keychain properly.

16 September 2026 · 6 min read

Mobile

Preparing an iOS app for expertise: a practical checklist

Jailbreak and dynamic analysis protection, ATS, Keychain and preparing the IPA. What to check before submitting an iOS app for a cybersecurity expertise.

26 August 2026 · 8 min read

Mobile

SSL pinning: locking down certificates in a mobile app

If an app accepts any certificate the system trusts, its traffic can be intercepted. How to set up pinning on Android and in Flutter, and how to prepare for certificate rotation.

26 August 2026 · 7 min read

Mobile

Android: allowBackup, cleartext traffic and network security config

Three AndroidManifest settings often turn into mobile expertise findings. How to configure backups, unencrypted traffic and certificate trust correctly.

5 August 2026 · 7 min read

Mobile

Root and jailbreak detection: why it matters and how to implement it

On a rooted or jailbroken device an app's protections weaken. Why security reviews rate this as high risk and how to implement detection properly.

5 August 2026 · 6 min read

Mobile

App integrity and obfuscation: R8 and Dart --obfuscate

Mobile security expertise checks how well an app resists tampering and reverse engineering. How to set up R8, Dart obfuscation and an integrity check.

15 July 2026 · 7 min read

Mobile

What a mobile app security review checks closely: MASVS, MASWE and OWASP Mobile Top 10

Which standards a mobile app security review relies on and which weaknesses it finds in practice. The 9 findings from our own app, grouped by severity.

14 July 2026 · 7 min read