Mobile Security Checker

Check a change for credentials committed in code, tests, fixtures, comments or config, and for secrets shipped inside an app binary where they are readable by anyone.

Check that a change authorizes as well as authenticates — that knowing who someone is has not been mistaken for knowing what they may do — and that the server enforces independently of the client.

Trace where sensitive data goes in a change — responses, logs, analytics, crash reports, third-party SDKs, device storage and backups — and flag what leaves that should not.

Check for injection through constructed queries, commands or markup, and for deep links and redirects that accept a destination from outside the app.

Scrutinise added, upgraded or downgraded dependencies for supply-chain risk, treating every addition as a permanent commitment and every downgrade as worth explaining.

Assemble the security audit with the verdict first, credential exposure separated from everything else, and an explicit statement of what was not examined.