M5: Insecure Communication
Cleartext traffic, weak TLS configuration, or disabled certificate pinning that exposes data while it moves between the app and its backend.
Why It Matters
Data in transit is the easiest place for an attacker on the same network (public Wi-Fi, a compromised router, a malicious VPN) to intercept traffic without touching the device or the backend at all.
Application to Application Security
Covers plaintext HTTP endpoints, Android's usesCleartextTraffic manifest flag, iOS App Transport Security exceptions in Info.plist, and outdated TLS versions or cipher suites still being negotiated.
Relation to Software Development
ATS exceptions and cleartext flags are frequently added during development to hit a local or staging server and then never removed before the release build ships.
How Strata Surfaces This
Static detection of http:// URLs in source and config, manifest analysis for cleartext traffic flags, Info.plist ATS exception parsing, and TLS version/cipher suite checks against the app's network security configuration.
Developer guidance
Enforce TLS 1.2+ for every network call, remove ATS exceptions and cleartext-traffic flags before a release build, and implement certificate pinning for high-value endpoints.
Management guidance
Ask whether cleartext exceptions are tracked and reviewed before each release, since they are the kind of debug-time convenience most likely to survive unnoticed into production.