Mobile app penetration testing for iOS and Android

What we test

We test your app against the areas of the OWASP Mobile Application Security Verification Standard (MASVS) that apply to it, and the APIs behind it.

• Data on the deviceMASVS-STORAGE

  What the app writes to storage, logs and backups, and whether sensitive data leaks.

• CryptographyMASVS-CRYPTO

  How the app encrypts data and handles keys, including keys or secrets left inside the app itself.

• Login and sessionsMASVS-AUTH

  Authentication, session handling, one-time passwords, biometric login and the extra checks that sensitive actions need.

• Network trafficMASVS-NETWORK

  Encryption in transit and certificate validation, including certificate pinning where you use it.

• Interaction with the platformMASVS-PLATFORM

  Deep links and other inter-process communication (IPC), WebViews and what the screen exposes.

• CodeMASVS-CODE

  Input handling, third-party components with known vulnerabilities and how the app enforces updates.

• Resistance to reverse engineeringMASVS-RESILIENCE

  Root and jailbreak detection, tampering and obfuscation, where your risk calls for them.

• PrivacyMASVS-PRIVACY

  What personal data the app collects and shares, and whether it needs it. This matters under the PDPL.

• The APIs behind the appBOLA / IDOR

  Access control between users, mass assignment, rate limits and business logic such as payments, wallets, coupons and bookings.

When to test your app

• Before launch or a major release, so you fix problems before your customers find them.
• When you add payments, a wallet or OTP login, or anything else that moves money or personal data.
• When a regulator or a customer asks for it. ECC control 2-11-3-1 names smartphone and tablet applications among the internet-facing services that entities in scope must test, and SAMA's Cyber Security Framework calls for annual tests of customer and internet-facing services. See NCA ECC and SAMA CSF.
• Before a funding round or a large customer's security review, when you may be asked for a recent penetration test report.

What we need from you

• The Android build (APK or AAB) and the iOS build (TestFlight or IPA)
• A test account for each user role, for example customer and admin
• An environment to test against, ideally staging. If we test production, we agree testing windows and stop conditions first
• API documentation, such as an OpenAPI file or a Postman collection, if you have one

Testing is grey-box by default: we use the app as your customers do, with the test accounts you provide. If you can share the source code, a white-box test lets us look deeper.

What you receive

• An executive summary of your risk in business terms
• A technical findings report with CVSS scores, evidence and reproduction steps, so your developers can confirm each finding on their own devices
• A remediation roadmap with guidance for your stack, whether the app is native or cross-platform
• Findings mapped to the frameworks you report against, such as NCA ECC, SAMA CSF and PDPL
• A record of the MASVS areas the test covered
• A readout session with your team
• One retest of all confirmed findings within 90 days at no extra cost, then a closure letter recording the status of each finding

If we confirm a critical finding, we tell your named contact within 24 hours, so you do not have to wait for the final report.

Price and timeline

We send a fixed price and a timeline once we know the size of your app: how many user roles, screens and API endpoints it has, and whether you need one platform or both. There is no hourly billing, and the retest is included.

Common questions