Mobile Application Security Checklist

A mobile assessment should cover the application, local data, platform controls and the APIs behind the mobile client.

Checklist

1. Review authentication, session and token storage.
2. Check local storage for credentials, tokens and sensitive business data.
3. Assess transport security and certificate validation where applicable.
4. Review exported components, deep links and platform permissions.
5. Test API authorization independently of the mobile interface.
6. Inspect sensitive logging, backup behavior and debug exposure.
7. Validate cryptographic use and secret management.
8. Document exploitable paths with reproducible evidence.