Checklist · Security
Mobile App Security Checklist
Opens with creditsA mobile app security checklist for Android, iOS, Flutter and React Native apps, organised by the eight OWASP MASVS categories. Every check says how much it matters and how to verify it on a real build, using platform tools or the techniques in the OWASP Mobile Application Security Testing Guide.
Written by Tauseef Fayyaz8 chapters, 36 checksAbout 22 minReviewed 13 October 2026What you will learn
8 chapters · about 22 min
1Data storage (MASVS-STORAGE)Checks that secrets never ship in the app, and that sensitive data kept on the device stays in the app sandbox, protected by platform key storage.6 checks · 4 min
- 1No API secrets, private keys or admin credentials are compiled into the app
- 2Tokens and sensitive data are stored with Keychain or Keystore-backed encryption
- 3Release builds do not log tokens, personal data or request bodies
- 4Sensitive files are never written to shared or external storage
- 5Sensitive screens and data are excluded from backups and app switcher snapshots
- 6Passwords and codes are not left on the clipboard or learned by the keyboard
6 in this chapterOpen this chapter2Cryptography (MASVS-CRYPTO)Checks that the app uses platform cryptography correctly, with keys generated and held by the platform rather than written into code.3 checks · 2 min
- Network communication (MASVS-NETWORK)Checks that every connection uses TLS that is actually validated, with no debug shortcuts left in release builds.5 checks · 3 minOpens with credits
- Authentication and sessions (MASVS-AUTH)Checks that the server makes every access decision, and that tokens on the device are short-lived, protected and revocable.5 checks · 3 minOpens with credits
- Platform interaction (MASVS-PLATFORM)Checks on how the app exposes itself to other apps and to web content: components, intents, deep links, WebViews and permissions.5 checks · 3 minOpens with credits
- Code quality and dependencies (MASVS-CODE)Checks that release builds are built for release, dependencies stay current, and the app treats server and local data with care.6 checks · 3 minOpens with credits
- Resilience and app integrity (MASVS-RESILIENCE)Checks for apps that need to detect tampering or abuse, with the server, not the app, making the final decision.3 checks · 2 minOpens with credits
- Privacy (MASVS-PRIVACY)Checks that the app collects only what it needs, says honestly what it collects, and gives users control.3 checks · 2 minOpens with credits
About this checklist
This mobile app security checklist starts from one fact: anything you ship inside an app belongs to whoever installs it. The binary can be unpacked, its strings read, its traffic intercepted on a device the user controls, and its local files opened on a rooted or jailbroken phone. A secure mobile app keeps secrets and decisions on the server, protects the data it must keep on the device with the platform's own key storage, and talks to its backend only over properly validated TLS.
The checks follow the OWASP Mobile Application Security Verification Standard (MASVS), whose current version 2.1.0 groups controls into eight categories: storage, cryptography, authentication, network, platform interaction, code quality, resilience and privacy. Each chapter here maps to one of those categories. The platform details come from Android's security guidance and network security configuration docs, Apple's App Transport Security documentation, and Google's Play Integrity API. For how to test each area in depth, the OWASP Mobile Application Security Testing Guide (MASTG) reached version 2.0.0 in June 2026.
Each check has a severity. Must means fix it before release; should means fix it soon; nice means worth doing once the rest is solid. Most checks can be verified on a release build with free tools: unzip the package and search it, read the manifest or Info.plist, watch traffic through a proxy on a test device, and inspect the app's sandbox on an emulator.
Common questions
What is OWASP MASVS?
The Mobile Application Security Verification Standard is OWASP's standard for mobile app security. Version 2.1.0 groups its controls into eight categories: storage, cryptography, authentication, network, platform interaction, code quality, resilience and privacy. The companion testing guide, MASTG, explains how to test each control.
Is it safe to put an API key in a mobile app?
Only if the key is designed to be public and its real protection lives elsewhere, such as restrictions by app signature or server-side rules. Secret keys for paid APIs, payments or admin access must stay on your server, and the app should call your backend, which calls the provider.
Do I need certificate pinning in my mobile app?
It is an extra layer, not a requirement for most apps. Correct TLS validation, no cleartext traffic and trusting only system CAs matter more. If you pin, Android's documentation says to include a backup key so a certificate change does not break the app.
Where should a mobile app store login tokens?
In the iOS Keychain, or on Android encrypted with a key from the Android Keystore. Cross-platform apps can use libraries that wrap both. Plain preferences, AsyncStorage or files in the app folder can be read from backups and rooted or jailbroken devices.
Does root or jailbreak detection make an app secure?
No. It can be bypassed by someone who controls the device, so it only raises the cost of attacks. Use it as one signal alongside server-verified attestation such as Play Integrity or App Attest, and keep every real security decision on the backend.
Does Android allow HTTP traffic by default?
Not for apps targeting Android 9 (API level 28) or higher: cleartext traffic is disabled by default and an app has to opt in, ideally for one named domain. Apps targeting API 27 or lower allow it by default.
Sources (7)
Checked against these, last on 13 October 2026.
- OWASP MASVS, OWASPmas.owasp.org/MASVS/
- OWASP MASTG releases, OWASPgithub.com/OWASP/mastg/releases
- OWASP Mobile Top 10, OWASPowasp.org/www-project-mobile-top-10/
- Security tips, Android Developersdeveloper.android.com/privacy-and-security/security-tips
- Network security configuration, Android Developersdeveloper.android.com/privacy-and-security/security-config
- Play Integrity API overview, Android Developersdeveloper.android.com/google/play/integrity/overview
- Preventing insecure network connections, Apple Developerdeveloper.apple.com/documentation/security/preventing-insecure-network-connections
Related on Sefism
Picked from the other libraries by shared topics.
Best practices
See all- React Native Best PracticesReact Native best practices for 2026: Expo and the New Architecture, fast lists, smooth animations, safe storage, deep links, accessibility and release builds.
- Flutter Best PracticesFlutter best practices for 2026: sound null safety, cheap build methods, layered architecture, smooth frames, go_router, accessibility, testing and safe releases.
Checklists
See allProject structures
See all- Flutter project structureFor anyone building one Dart app for Android, iOS and the web. The tree starts from what flutter create gives you and grows into a feature-first lib/ folder, where each feature keeps its own data, domain and presentation code, then adds tests at every level, flavors, release signing, crash reporting and, for large teams, a melos workspace of local packages.
- React Native with Expo project structureFor web developers who know React and want one TypeScript codebase for Android, iOS and the web. Routes are files in src/app (Expo Router), the business logic lives in feature folders under src/features split into data, domain and presentation, and the native android and ios folders are generated, not hand-written.
- Android with Kotlin and Compose project structureFor anyone building a native Android app the way Google recommends in 2026: Kotlin, Jetpack Compose, a ViewModel per screen, repositories over Room and the network, and Hilt wiring it together. The tree starts from Android Studio's Empty Activity template, grows into feature packages with data, domain and presentation, adds signing, shrinking, CI and crash reporting for production, and ends as a multi-module build with convention plugins, Baseline Profiles and staged rollouts.
Career questions
See allStuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com