mobile-app-security

Mobile App Security (MASVS)

Overview

The app binary is public and the device may belong to the attacker. Two consequences shape every mobile finding: anything shipped in the app is readable (a "hidden" server secret is leaked), and any check done only in the app can be skipped (the server is the boundary). What remains for the app is protecting its user from other apps, other networks and other web content.

Core principle: ask who the attacker is — another app on the device, someone on the network, a web page in a WebView, or the device owner. Findings against the device owner protecting their own data are usually not findings.

1. Secrets Shipped in the App (MASVS-CRYPTO, MASVS-CODE)

A server secret in BuildConfig, Info.plist, a bundled .env, strings.xml, Dart constants or an obfuscated string is a leaked secret — CRITICAL when live (secrets-and-crypto-review).

Not findings: Firebase google-services.json / GoogleService-Info.plist, Maps keys restricted by app signature, publishable payment keys. But the Firebase rules that protect the data are in scope:

// ❌ firestore.rules — every client reads and writes everything
match /{document=**} { allow read, write: if true; }
// ✅
match /users/{uid} { allow read, write: if request.auth != null && request.auth.uid == uid; }

2. Storage (MASVS-STORAGE)

❌ for tokens and credentials	✅
Android SharedPreferences, plain files, SQLite, external storage	Keystore-backed encryption (Tink/AndroidX security), DataStore with an encrypted serializer
iOS UserDefaults, plist files, unencrypted Core Data	Keychain with an appropriate kSecAttrAccessible…ThisDeviceOnly class
Flutter shared_preferences, Hive unencrypted	flutter_secure_storage

Severity follows the attacker: world-readable files (MODE_WORLD_READABLE, external storage) or data included in backups (android:allowBackup="true" without exclusions) → HIGH for credentials; private app storage on a non-rooted device → MEDIUM note. Tokens in Log.d/print/NSLog → readable by logcat tools and crash reporters → MEDIUM to HIGH.