Android gives attackers more room than iOS: a decompilable APK, an inter-process communication model that many apps expose by accident, and a device population where rooting is routine. Testing has to cover what the app leaks, what other apps on the device can reach, and what happens once the runtime is under someone else's control.
What we test
- Static and binary analysis — APK decompilation and review, hardcoded keys, credentials and endpoints, obfuscation effectiveness, debuggable and backup flags, third-party SDK and library review, embedded Firebase and cloud configuration
- Exported components — activities, services, broadcast receivers and content providers reachable by other apps; intent redirection, permission bypass, and SQL injection through content providers
- Insecure data storage — SharedPreferences, SQLite and Room databases, internal and external storage, logs, clipboard, screenshots in the recents view, and what survives an adb backup
- WebView security —
addJavascriptInterface exposure, file and content URL access, mixed content and injection into loaded pages
- Deep links and app links — hijacking, parameter injection and unvalidated redirects through intent handling
- Transport and runtime defences — certificate pinning implementation and bypass, root detection strength, Frida and Objection hooking, tampering with client-side checks, repackaging resistance and Play Integrity usage
- Authentication and session handling — biometric prompt bypass, token storage, session lifetime and logout behavior
- Backend interaction — the APIs behind the app, tested for authorization and tenant isolation flaws
What we need from you
A release-configuration APK or AAB (not a debug build, unless you want both compared), test accounts per role, and a note of any device or OS versions you must support. Testing is performed on rooted devices for instrumentation and on stock devices to confirm real-world impact.
Who it is for
Fintech, wallet and lending apps, healthcare apps handling ePHI, retail and delivery apps processing payments, and enterprise apps distributed through MDM where a compromised device is a realistic threat model.
Frequently asked
Our app is obfuscated. Is testing still useful?
Yes, and part of the value is telling you how much the obfuscation actually bought. We report how long it took to recover the logic that matters and whether secrets survived the process.
Can you test root detection and anti-tampering?
That is a standard part of the engagement. We assess the controls, attempt bypass with standard tooling, and report the effort required — which is the number your risk team needs, not a pass or fail.
Do you test both Android and iOS together?
Most clients scope both plus the shared backend. Testing them in one engagement means one report, one remediation cycle and one attestation letter covering the whole mobile surface.