Your app in an attacker’s hands.
We test your iOS and Android apps against the OWASP Mobile Application Security Verification Standard, on real devices, together with the API behind them, where most of the serious findings are.
- Price
- Set in your written proposal
- You receive
- Findings for each platform and for the API, with evidence and fixes.
Scope, timeline and price in writing before any work starts.
What we test. On the device and behind it.
- 01
Local storage
Tokens, personal data and keys left on the device, in logs, backups or caches.
- 02
Network traffic
TLS, certificate pinning, and what the app sends and accepts.
- 03
Authentication
Login, biometrics, session handling, and how the app and the API agree on who you are.
- 04
Tampering and reverse engineering
What an attacker learns or changes by decompiling or modifying the app.
- 05
Back-end API
The endpoints the app uses, tested as in our web application and API testing.
Questions, answered.
01Do you need our source code?
No. A build for each platform is enough. Source code lets us go faster and deeper.
Know where you stand before an attacker does.
Tell us what you want tested. We will come back with a scope, a timeline and a price.