Mobile App Security Review Checklist

A debuggable release build allows ADB attachment and inspection on any device — never appropriate for production.

The default allows full app data extraction via adb backup on unencrypted devices — decide explicitly rather than inheriting the platform default.

Older target SDKs receive more permissive defaults for permissions and background behavior on newer OS versions.

An unused declared permission is pure attack surface with no corresponding benefit.

Location, contacts, SMS, and similar groups warrant a written reason a reviewer (or app store) can evaluate.

A dependency's own manifest merge can add permissions the app team never explicitly requested.

Cleartext traffic is trivially interceptable on any network the device joins.

Pinning defends authentication and payment endpoints against a broader class of interception than TLS alone.

A broad exception added for one debug endpoint can end up covering far more than intended.

Plaintext local storage is trivially readable given root, jailbreak, or backup extraction access.

External storage is readable by any app holding the relevant storage permission, not just the app that wrote the file.

An empty or overridden trust check silently defeats TLS's authentication guarantee.

Mobile apps can't reliably keep a client secret confidential — PKCE is the mitigation designed for that constraint.

Token storage location determines whether a device-level compromise also compromises the user's session.

These algorithms are cryptographically broken for security purposes even though they remain available in standard libraries.

A hardcoded key is extractable from the binary by anyone who obtains it, defeating the encryption entirely.

ECB mode leaks structural patterns in the plaintext even when the underlying cipher is strong.

Debug logging that includes a token or password is one of the most common accidental data leaks in mobile apps.

Third-party crash and analytics tooling can capture more request/response detail than the team realizes by default.

An exported component with no permission requirement is reachable by any other app on the device.

These receivers are common, easily overlooked targets since they trigger without direct user interaction.

The Android debug keystore is shared across every developer's environment and is not a secret.

V1-only signing is vulnerable to APK tampering exploits (e.g. the Janus class of attack) on older Android versions.

An Enterprise-signed IPA bypasses App Store review entirely — verify that's actually the intended distribution path.

A deep link handler is an input entry point exactly like a network API — unvalidated parameters carry the same injection risk.

A custom scheme claimed by more than one installed app creates ambiguity an attacker can exploit.