Mobile App Security: 10 Common Vulnerabilities & Fixes
Mobile apps in India increasingly hold sensitive financial and personal data, and OWASP Mobile Top 10 issues are common in fast-shipped products. Ten concrete checks cover most of the real risk. The ten to fix…
Mobile apps in India increasingly hold sensitive financial and personal data, and OWASP Mobile Top 10 issues are common in fast-shipped products. Ten concrete checks cover most of the real risk.
The ten to fix
- Insecure data storage — sensitive data in SharedPreferences or UserDefaults without encryption. Use Android Keystore / iOS Keychain.
- Hardcoded secrets — API keys in source. Move to runtime config from a secure backend.
- Cleartext network traffic — HTTP instead of HTTPS, or accepting invalid certificates. Enforce TLS, consider pinning for high-value endpoints.
- Weak authentication — short tokens, no expiry, missing refresh-token rotation.
- Insufficient session handling — no logout on the server, no kill-switch for compromised tokens.
- Deep link abuse — unvalidated parameters leading to navigation or data exposure.
- Insecure WebViews — JavaScript bridges that leak app capabilities to remote pages.
- Backup leakage — secrets ending up in cloud backups. Use no-backup flags for sensitive files.
- Insufficient cryptography — using MD5, SHA-1, ECB mode, or rolling your own. Use AES-GCM and platform primitives.
- Reverse engineering exposure — no code obfuscation, debug symbols shipping. Use R8/ProGuard and strip symbols.
The pre-release checklist
Run static analysis (MobSF for both platforms). Review network traffic with a proxy on a test device. Pen test before any release that exposes new sensitive flows. Two days of structured review prevents most embarrassing bugs.
The release-process layer
Lock SDK and library versions. Monitor for known CVEs in dependencies. Plan a force-update mechanism for critical security fixes. Without these three, even a clean codebase rots over six months.
Why it matters now
The RBI, SEBI, and DPDP regulations have raised the cost of security incidents for any app touching financial or personal data. Investing two weeks per year in mobile security review is now cheaper than the regulatory fines and reputational damage of one breach.
