Mobile Application Security Testing for iOS and Android: A Checklist

Data storage and privacy

• Sensitive data is not stored on the device unencrypted.
• Platform protections such as iOS Data Protection are actually enabled, not just configured.
• Secrets, tokens and credentials are not hardcoded or written to logs.
• You know what personal data the app collects and which third parties receive it.

Network and communication

• All traffic uses strong encryption, with no cleartext fallbacks.
• Certificate validation is enforced; consider SSL pinning for sensitive apps.
• You know which countries the app's traffic is routed through.

Authentication and sessions

• Session tokens are stored securely and expire properly.
• Authentication flows cannot be bypassed through deep links or exported components.

Backend APIs

• Every API the app calls is inventoried, including undocumented ones.
• APIs enforce authorization on every object and function (no BOLA).

Third-party code

• Every embedded SDK and open source library is in an SBOM with known vulnerabilities attached.
• SDK data collection matches your privacy disclosures.

Platform and store requirements

• Known App Store and Google Play blockers are checked before submission.
• The app supports the latest iOS and Android versions on day one.

Code and build

• Source code is scanned with SAST, including Swift and Kotlin specific checks.
• Findings are prioritized by exploitability, not just severity.
• The binary is hardened against reverse engineering for apps that need it.

Process

• Testing runs automatically on every release, not once a quarter.
• Fixes reach developers with clear remediation guidance.
• Runtime protection defends the app while fixes are pending.

• Automated, fully authenticated binary scans of every iOS and Android release, with no jailbroken or rooted devices required and day-one support for new OS versions.
• SAST, DAST, forced-path execution and privacy analysis, covering the OWASP Mobile Top 10 in full and the OWASP mobile testing guide (MSTG).
• Privacy findings on what data the app collects, what it shares with third parties, what it stores unencrypted and what it sends to backend APIs.
• A complete SBOM of embedded SDKs and open source libraries, with findings attached.
• App Store blocker detection, a capability Data Theorem has maintained for over 13 years.
• AI Exploits chains mobile findings into the exploit path an attacker would take, and AI Auto-Remediation sends fixes to your code through Code SAST Secure.