Mobile App Security: The Practices That Actually Matter
Key takeaway
Treat the mobile app as untrusted: anything shipped in the binary can be read, and any API it calls can be called directly. Real mobile security comes from server-side authorization, keychain-backed storage, certificate-aware transport, and never shipping a secret in the app.
Mobile security reviews tend to focus on the app. Attackers focus on the API behind it. Both matter, but the second is where the serious findings usually are — because developers assume that only their app will ever call it.
The starting assumption
Anyone can decompile your app, read its strings, watch its traffic on a device they control, and replay its requests. Every control that lives only in the client is a speed bump. Design as if a hostile client is calling your API, because eventually one will.
Storage on the device
- Use the Keychain (iOS) or Keystore/EncryptedSharedPreferences (Android) for tokens and credentials — never plain preferences files or local databases.
- Don't cache sensitive data in logs, crash reports, or screenshots; mark sensitive screens to be excluded from the app switcher snapshot.
- Assume backups may be extracted, and exclude sensitive files from automatic cloud backup.
Data in transit
- TLS everywhere with modern cipher suites, and no exceptions for development that ship to production.
- Consider certificate pinning for high-value apps — with a rotation plan, because a pin outliving its certificate bricks the app.
- Never send credentials or tokens as URL parameters; they end up in logs and proxies.
Authentication and the backend
- Short-lived access tokens with refresh, and server-side revocation that actually works.
- Authorise every request server-side on the identity in the token — never on an ID supplied by the client. "Can this user read record 4172?" must be answered by the server.
- Rate limit and monitor per account and per device, not just per IP.
- Offer biometric unlock as a convenience over a real credential, not as a replacement for authentication.
Secrets and third parties
- No API keys with real privileges in the binary. If a key must ship, scope it so it can do nothing dangerous.
- Audit SDKs — analytics and ad libraries have broad access to your app's data and are a genuine supply-chain risk.
- Keep dependencies patched; mobile releases go through store review, so plan for the lag.