App Security Audit for Android and iOS
The Squad examines the shipped build of your Android or iOS app at source-code level: decompiled code, embedded keys, network configuration, third-party SDKs and every data flow that leaves the device. Human specialists re-verify each finding. You receive a written report with the evidence behind every result.
What the audit covers
A mobile app is a bundle of your own code, third-party libraries and configuration that the app store delivers to every phone. The audit treats that bundle as the object of study. Our in-house agents run thousands of parallel tests across code, dependencies, APIs, configurations and attack surfaces, then correlate the results to separate isolated signals from broader security issues.
Five areas make up the scope of every review:
- Source and dependencies: code, third-party libraries and their versions.
- Authorization and actions: permissions, data access and abuse paths.
- API authorization logic: authentication, access control and trust boundaries.
- Credentials and data flows: exposed keys, embedded SDKs, flows to third parties.
- Misconfigurations and bugs: insecure defaults, overly broad permissions, software defects.
Deep Scan of the build as shipped
The investigation decompiles the binary that the store distributes and reads it. That shows what the app does today, which can differ from the documentation, the privacy policy and the data-safety form in the store. Every claim in a report traces back to a specific manifest entry, permission or decompiled class.
You decide what we examine. Send a GitHub link, a repository archive, a package build or an API specification. The audit needs no access to your live systems.
Typical findings in an app security audit
These finding classes appear again and again in the audits we have published:
- Hardcoded keys and credentials: cloud API keys, push-notification credentials and backend tokens inside the installable package.
- Network configuration: cleartext traffic permitted, an empty network security config, missing certificate pinning, user-installed certificate authorities trusted on a payment app.
- Backup and storage: Android backup enabled without exclusions, locally stored data without encryption.
- Over-broad permissions: microphone or location declared with no feature that needs them.
- Leftovers from development: debug overlays and staging backend domains shipped in the production build.
How an audit runs
Four steps carry every review. Send: you hand over the material. Examine: our team and one, several or all of our agents work through source, configuration and data flows together. Re-verify: human specialists check every finding before it reaches the report. Evidence: we document the examination in writing, with the evidence for each finding.
The report checks exploitability, meaning what an attacker could realistically do with a finding, ranks severity with CVSS where applicable, and gives remediation guidance. Testing follows OWASP ASVS, the OWASP Top 10 and CWE. Every report ships with a base knowledge graph that links the findings. The Security offer on the Access page states a delivery estimate of 5 business days.
Evidence from audited apps
Our public ledger lists 387+ audited Android and iOS apps and 262+ critical findings, each with its full report. These reports show the finding classes above in real apps:
- Starbucks Austria: Two hardcoded Firebase keys, one shared verbatim with a competing brand.
- SoundCloud: Seven hardcoded production API credentials in one installable package.
- Nike: Development and production push credentials both hardcoded in the Play Store build.
- Strava: A network security configuration that exists but is empty, with no certificate pinning.
Start with the free check
The free check examines one domain from the outside: read-only, from a European IP address, with no login and no payloads. A researcher reviews your request and replies within one business day. The result is an initial external assessment and does not replace a source-code review.
A full app security audit starts from the plans on the Access page.
See plans and pricing → · Meet The Squad → · Standards and frameworks →
The initial check is read-only, performed from a European IP address, with no login and no payloads. Your systems remain unchanged.
A researcher reviews your request before any check begins and replies within one business day. You receive a short written report with our findings, likely attack scenarios, the potential financial impact and clear next steps, plus a knowledge graph of everything we found. All free.
Questions about app security audits
What does an app security audit cost?
The Access page lists the plans from Starter to Business with their prices, plus an Enterprise option for custom surfaces. Each plan states its scope and what you receive.
Which platforms do you cover?
Android and iOS apps, together with the APIs and backends they talk to, within the scope you agree.
Do you need access to our production systems?
No. You choose what we examine and send us the material. We need no access to your live systems.
Who verifies the findings?
Human specialists re-verify every finding before it reaches the report. Agents do the broad testing, people decide what counts as a finding.
Does a client report become public?
A client's private data, environments and results stay private unless the client approves publication in writing.
Related pages
GDPR App Audit · NIS2 for Software Vendors · Tracker & SDK Check
