iOS app security assessment
from any IPA file.

Strata performs static analysis on iOS IPA files — parsing Info.plist, entitlements, the provisioning profile, and the main binary to surface real security issues with OWASP mapping, severity scoring, and remediation guidance. No Xcode project, no source code, no device required.

Static analysis only
No runtime execution required
No source code needed
Analyse any IPA binary
OWASP M1–M10 mapped
Industry-standard coverage

What is IPA security scanning?

Static analysis of iOS app archives

An IPA (iOS App Archive) is a ZIP file containing a Payload/*.app bundle — the Info.plist manifest, a compiled Mach-O binary, an embedded provisioning profile, entitlements, frameworks, and resources. IPA security scanning examines those files without running the app.

Static analysis works directly from the compiled archive: no device, no Xcode, no source code. This makes it practical for third-party assessments, pre-release security reviews, and supply chain analysis of apps you didn't build.

Static analysis has well-defined limits: it cannot observe runtime behavior, intercept live network traffic, or test server-side logic. Strata focuses on what static analysis of IPA files does reliably — manifest configuration, binary string scanning, entitlement analysis, and provisioning profile inspection.

Works on any IPA binary — no source code, no device needed
Results in under 30 seconds
Findings mapped to OWASP Mobile Top 10 (M1–M10)
Accurate language: static analysis only, not dynamic
IPA file layout
📦BankingApp_v2.1.ipa
📁Payload/
📁 BankingApp.app/
📄 Info.plist← permissions, ATS, URL schemes
🔢 BankingApp← compiled Mach-O binary
🪪 embedded.mobileprovision← signing + entitlements
📋 Entitlements.plist← capabilities granted
📁 Frameworks/← embedded .framework bundles
📁 PlugIns/← app extensions

iOS security issues Strata detects

These are the most common security problems found in iOS apps — each one detectable through static analysis of the compiled IPA.

OWASP M3

App Transport Security disabled

NSAllowsArbitraryLoads=true in Info.plist disables ATS globally, allowing the app to make plaintext HTTP connections to any server. This is one of the most frequently flagged issues in iOS security assessments, and is detectable directly from the Info.plist in the IPA.

OWASP M8

Debug entitlement in distribution build

The get-task-allow entitlement allows debugger attachment. Xcode adds it automatically to debug builds; it must be absent in any distribution build. When found in an enterprise or App Store IPA, it means any process with sufficient privileges can attach, inspect memory, and extract runtime secrets.

OWASP M1

Hardcoded credentials in the binary

API keys, tokens, and secrets compiled into the binary are extractable by anyone who unpacks the IPA. Strata scans the main Mach-O binary for AWS credentials, Firebase keys, Stripe keys, GitHub tokens, JWT strings, and over a dozen other credential patterns.

OWASP M1

Always-on location with background mode

An app declaring NSLocationAlwaysUsageDescription while also enabling the location background mode can track the user's physical location continuously without any visible UI indicator. Strata flags this combination as a high-risk privacy exposure.

OWASP M1

Enterprise provisioning profile

An IPA signed with an enterprise profile (ProvisionsAllDevices=true) can be installed on any device without App Store review. This is a common distribution mechanism for internal tools — and for malware. Enterprise-signed IPAs bypass the App Store's security review entirely.

OWASP M10

Jailbreak and instrumentation tool strings

Strings matching Cydia, unc0ver, checkra1n, palera1n, Frida, and similar tools found in the binary indicate the app may interact with jailbreak infrastructure, include exploit tooling, or bundle a Frida gadget for runtime instrumentation.

What Strata checks

Every check listed below is performed automatically on every IPA scan. All analysis is static — no emulator, no device, no source code.

📋

Info.plist & permissions

All 20 iOS permission types — Camera, Microphone, Location, Contacts, Photos, Health, Face ID, and more
Always-on location (NSLocationAlwaysUsageDescription / NSLocationAlwaysAndWhenInUseUsageDescription)
User tracking permission (NSUserTrackingUsageDescription — ATT framework)
Background modes flagged by risk: fetch, remote-notification, location, voip, bluetooth-central, bluetooth-peripheral
UIFileSharingEnabled=true — app files accessible via Finder/iTunes
LSApplicationQueriesSchemes — queried external URL schemes
LSSupportsOpeningDocumentsInPlace — cross-app document access
Minimum iOS version warnings (< 12)
Registered URL schemes (CFBundleURLTypes)
🌐

App Transport Security

NSAllowsArbitraryLoads=true — cleartext HTTP permitted globally (OWASP M3)
NSAllowsArbitraryLoadsInWebContent — cleartext in embedded web views
Per-domain ATS exceptions with NSExceptionAllowsInsecureHTTPLoads
Missing NSAppTransportSecurity key (defaults may allow cleartext)
URLs extracted from the main binary for cross-reference
IP addresses found in binary strings
🔑

Hardcoded secrets

AWS access key IDs (AKIA...)
Google / Firebase API keys (AIza...)
JWT-like token strings
PEM private key material
Stripe secret keys (sk_live_, sk_test_)
GitHub personal access tokens
SendGrid, Twilio, Slack tokens
Mapbox public tokens (pk.eyJ1...)
Generic credential assignments (token=, api_key=, secret=, password=)
📜

Entitlements

com.apple.security.get-task-allow — debugger attachment permitted (OWASP M8)
Network Extension entitlement — can intercept or filter all network traffic
VPN API entitlement
HealthKit entitlement — sensitive health data access
HomeKit, Wallet/Passes, NFC entitlements
Keychain sharing groups — shared credential access across apps
Push notification environment — development vs production mismatch
🪪

Provisioning profile

Provisioning type: App Store / Enterprise / Development
Enterprise distribution flag (ProvisionsAllDevices)
Profile expiry detection
Team name and team ID extraction
App ID and bundle ID from profile
🧠

Binary & behavioral indicators

Jailbreak tool strings: Cydia, unc0ver, checkra1n, palera1n, Sileo, Magisk
Dynamic instrumentation markers: Frida, FridaGadget, cynject, sbinject, Substrate
SSL/TLS bypass function names: SSLHandshake, SSLSetSessionOption, ssl_verify_peer, kSSLSessionOptionBreakOnServerAuth, NSTrustCertificateErrors
Embedded frameworks (.framework bundles) and dynamic libraries (.dylib)
Composite risk score (0–10, LOW / MEDIUM / HIGH)

From upload to remediation

IPA security scanning is the first step. Strata gives you the workflow to act on what you find.

01

Upload the IPA

Upload the IPA file directly — no Xcode project, no source code, no device needed. An IPA is a standard ZIP archive; Strata reads the Payload/*.app bundle inside it.

02

Static analysis runs

Strata parses Info.plist, the provisioning profile, entitlements, and the main Mach-O binary. Permission and ATS checks, secret scanning, jailbreak indicator detection, and heuristic scoring all run in parallel. Results are typically ready in under 30 seconds.

03

Review severity-ranked findings

Findings are ranked by severity with plain-English explanation, OWASP Mobile category, concrete impact statement, and remediation guidance for each.

04

Triage and track

Move findings through a lifecycle — Open → In Progress → Fixed or Accepted Risk. Add notes, mark false positives, and maintain a clear record of what still needs action.

05

Export a client-ready report

Generate a PDF with executive summary, severity breakdown, OWASP coverage, and per-finding evidence — suitable for developer handoff, App Store compliance review, or client delivery.

What makes iOS security analysis different

The iOS security model is entitlement-driven

Unlike Android's manifest-declared permission model, iOS security is largely governed by entitlements — capabilities cryptographically granted to the app by Apple and embedded in the provisioning profile. This means an IPA's security posture is partly determined by what Apple has authorized it to do, not just what the developer declared.

Strata reads the embedded provisioning profile directly from the IPA, extracts entitlements, and flags high-risk ones: the debugger-attachment entitlement (get-task-allow), network traffic interception (Network Extension), and cross-app keychain sharing. It also identifies whether the profile is an App Store, enterprise, or development build — each carrying different risk implications.

App Transport Security (ATS) is iOS's equivalent of Android's usesCleartextTraffic flag — but with more granularity. Strata checks both the global allowance and per-domain exceptions in Info.plist, giving you a precise picture of where cleartext HTTP is and is not permitted.

Entitlement analysis — not just permission keys
Provisioning type detection — App Store vs enterprise vs development
ATS global and per-domain exception parsing
Background mode risk classification
Provisioning type
Enterprise (ProvisionsAllDevices)
Bypasses App Store review
get-task-allow
true
Debugger attachment permitted
NSAllowsArbitraryLoads
true
Cleartext HTTP globally
Keychain sharing
2 groups
Credentials shared across apps
Background location
enabled
Continuous location tracking
Profile expiry
2024-03-01 (expired)
Distribution profile expired

Common Questions

No. The IPA scanner reads Info.plist, the provisioning profile, entitlements, and the compiled Mach-O binary directly from the IPA archive. No Xcode project, source code, or physical device is required.
No. Static analysis cannot observe runtime behavior, intercept live network traffic, or test server-side logic. It reliably surfaces Info.plist misconfigurations, entitlement risks, hardcoded secrets, and provisioning issues — a runtime or manual review covers different, complementary ground.
The checklist is the complete manual assessment methodology, including sections that need human judgment. The IPA scanner automates the fully deterministic subset of it — permissions, App Transport Security configuration, entitlements, and provisioning profile checks — straight from the binary.
The same checks run regardless of signing type, but the provisioning profile type (App Store, Enterprise, or Development) is itself part of the report — an enterprise profile carries different risk implications since it bypasses App Store review entirely, and Strata flags that distinction explicitly.

See Strata in action

Watch a walkthrough of the platform — from upload to full security report.

Demo video coming soon

Get a personalized walkthrough of Strata — we will cover your specific workflow live.

Request a Demo →

Run your first IPA scan
in under 30 seconds.

Free to start — upload an IPA and get a full security assessment with no credit card required. Upgrade for unlimited scans, findings lifecycle, and client-ready reports.