Mobile application development
Android and iOS apps with secure storage, safe APIs and a hardened release build.
- Secure local storage and keychain use
- Certificate pinning where appropriate
- Safe authentication and biometrics
- API authorisation by design
- Release hardening and obfuscation
- Security testing against MASVS
The business problem
Mobile users trust apps with payments, identity and location. That trust is lost quickly when data leaks from a device or an API.
Scope of work
Scope is agreed with you before any work starts. A typical engagement covers the areas below, adjusted to your environment, your priorities and any testing windows you need.
- Secure local storage and keychain use
- Certificate pinning where appropriate
- Safe authentication and biometrics
- API authorisation by design
- Release hardening and obfuscation
- Security testing against MASVS
Methodology
Security is considered at every stage, not checked at the end.
- Discovery
- Threat modeling
- Architecture
- Secure build
- Code review
- Security testing
- Release
- Support
Typical engagement timeline
Depends on scope. Planned in milestones.
Standards and references
- OWASP MASVS
- OWASP Mobile Top 10
Tools and techniques
- Native and cross platform frameworks
- Automated testing
- GARUDX code analysis
- Continuous integration
What you receive.
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Benefits
- Fewer vulnerabilities reach production
- Lower cost than fixing after launch
- Security evidence for your customers
- A codebase your team can maintain
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Why us.
- Experienced security professionalsAssessments are led by practitioners who do this work every day.
- Offensive security expertiseWe think like attackers because that is our core discipline.
- Manual validationEvery finding is confirmed by a person before it reaches your report.
- Enterprise focused assessmentsScoping, communication and reporting that fit large organisations.
- Transparent reportingEvidence, reproduction steps and plain language. No padding.
- Actionable remediationSpecific fixes your developers and administrators can apply.
Questions.
Do you security test what you build?
Yes. Every build goes through code analysis with GARUDX and security testing before release.
Can you work with our existing team and stack?
Yes. We can build alongside your developers or deliver a complete product, using the stack that fits the project.
Who owns the source code?
Ownership terms are agreed in the contract before work begins.
Do you support the product after launch?
Yes. Support and maintenance terms are agreed as part of the engagement.