NAVIGATION
Sitemap
Platform guides, topic collections and every article.
Platform guides
Protection foundations
- Runtime protection: where RASP fits in an application
- From protection signal to transaction decision: the RASP flow
- App shielding and RASP: understanding product scope
- The difference between in-app protection and antivirus
- What do mobile app protection and a WAF cover together?
- How SAST findings inform an application protection plan
- Combining DAST with mobile protection testing
- Mobile Threat Defense and application protection
- An application protection threat model for Android and iOS
- Drawing trust boundaries in a mobile application
- Should the device or server make a protection decision?
- Why root and jailbreak need distinct policies
- The practical contribution of code obfuscation
- Anti-tamper: detecting and stopping package modification
- How to assess anti-debugging controls
- Anti-hooking and the protection of critical functions
- App attestation: establishing application identity
- How false positives affect application protection
- Access during failures: fail-open and fail-closed
- Measuring the performance cost of application protection
- SDK, compiler and post-build protection options
- What questions should protection telemetry answer?
- Which vulnerabilities does application protection leave open?
- Defining success in an app protection proof of concept
- A learning path for Android app protection and iOS app protection
Android security
- Play Integrity API in Android app protection
- Play Integrity standard requests
- Play Integrity classic requests and nonces
- Interpreting Play Integrity verdicts
- Protecting key use with Android Keystore
- What Android StrongBox provides
- Android key attestation
- Android app signing and RASP
- APK, AAB and the final protected package
- Android R8 and runtime protection
- Android Network Security Configuration
- Designing certificate pinning on Android
- Approaching Android root detection
- Android emulator detection and legitimate use
- Android overlay and tapjacking defenses
- Balancing Android accessibility and security
- Android screen capture protection
- Android WebView security and RASP
- Android App Links and deep-link security
- Android exported components
- Android PendingIntent security
- Risks of dynamic code loading on Android
- Android native libraries and JNI
- Android backup and sensitive data
- Android Verified Boot and application trust
iOS security
- Apple App Attest in iOS app protection
- App Attest server verification
- Assessing device state with DeviceCheck
- Managing secret lifecycles with iOS Keychain
- Secure Enclave and the limits of application protection
- iOS code signing and application integrity
- Reviewing iOS entitlements
- iOS jailbreak signals
- iOS runtime integrity
- Objective-C method swizzling and security
- iOS dyld and loaded libraries
- Assessing iOS anti-debugging
- App Transport Security and application protection
- iOS certificate pinning and key transitions
- iOS biometrics and binding cryptographic operations
- iOS App Groups and shared data
- Protection coverage in iOS extensions
- The iOS background lifecycle and RASP
- WKWebView security and native bridges
- iOS Universal Links and secure transaction flows
- iOS privacy manifests and security SDKs
- What the iOS Simulator can show in security testing
- Crash symbolication for protected iOS builds
- iOS file data protection
- Release acceptance for iOS application protection
Threats and abuse
- What mobile reverse engineering can reveal
- Mobile application repackaging
- Mobile memory tampering and critical data
- Dynamic instrumentation and RASP testing
- Impersonating a mobile API client
- Replay attacks against mobile transactions
- Mobile session-token theft
- Account takeover and application protection
- Real-device farms and mobile automation
- Overlay-based fraud risk
- Remote-access tools and mobile transaction security
- Local code patching and business logic
- Secrets embedded in mobile applications
- Man-in-the-middle risk in mobile applications
- Why timing-based checks are fragile
- RASP approaches to environment concealment
- Third-party SDK supply-chain risk
- Sensitive-data disclosure in mobile logs
- Mobile data disclosure through the clipboard
- Screen mirroring and sensitive information
- The risk of trusting the client clock
- Location spoofing and mobile risk decisions
- Device identity and fingerprinting limitations
- Abuse of RASP configuration
- Interpreting a RASP bypass finding
Protection products
- DexGuard: Android application protection
- iXGuard: iOS code hardening and RASP
- Introducing Promon Shield for Mobile
- Appdome: a mobile application defense platform
- Introducing Digital.ai Application Security
- The Zimperium MAPS product family
- Assessing Zimperium zShield
- Zimperium zDefend and runtime risks
- DoveRunner and the former AppSealing name
- Introducing Talsec freeRASP
- Introducing Talsec RASP+
- Approov: app attestation and API protection
- AppSweep mobile security testing
- Mobile threat visibility with ThreatCast
- Introducing Guardsquare App Attestation
- Appknox mobile application security testing
- NowSecure mobile security assessment
- Introducing Quokka Q-mast
- Ostorlab mobile security analysis
- Oversecured mobile application scanning
- RootBeer: an Android root-checking library
- IOSSecuritySuite: a Swift security library
- Certificate pinning with TrustKit
- What is ProGuard, and can it replace RASP?
- Talsec AppiCrypt and server-side risk decisions
Analysis tools
- Frida: mobile runtime analysis
- objection: exploring mobile runtime behavior
- MobSF: a mobile security analysis platform
- Androguard: Android analysis with Python
- Inspecting Android code with JADX
- Apktool: Android resources and package inspection
- Analyzing mobile native code with Ghidra
- radare2: command-line binary analysis
- The Rizin binary analysis toolkit
- Cutter: a graphical analysis environment for Rizin
- Mobile binary inspection with Binary Ninja
- IDA Pro: the disassembler and decompiler ecosystem
- JEB Decompiler and Android analysis
- Inspecting Mach-O with Hopper
- LIEF: executable-file analysis with Python
- The Capstone disassembly engine
- The Unicorn CPU emulator
- angr: symbolic analysis with Python
- pwntools: Python automation for security laboratories
- Inspecting ELF and DWARF with pyelftools
- Automating radare2 with r2pipe
- dex2jar: DEX and Java class tooling
- What are smali and baksmali?
- Inspecting Android distribution packages with bundletool
- Verifying APK signatures with apksigner
Testing and device labs
- Burp Suite for mobile API security testing
- ZAP for mobile back-end security testing
- mitmproxy and Python traffic automation
- Examining mobile network behavior with Wireshark
- Charles Proxy for mobile traffic inspection
- Proxyman for mobile HTTP debugging
- HTTP Toolkit for mobile network inspection
- Caido for mobile API testing workflows
- tcpdump for mobile test-network captures
- ADB: a foundation of Android testing
- Android Emulator for application testing
- Appium for mobile RASP regression testing
- Maestro for mobile flow automation
- Detox for React Native security regression
- Espresso for Android security interface tests
- UI Automator for Android system flows
- XCTest and XCUITest for iOS verification
- Firebase Test Lab and device coverage
- AWS Device Farm for mobile application testing
- Corellium for virtual mobile research
- Managing Android test devices with scrcpy
- libimobiledevice for iOS device communication
- iproxy for iOS test connections
- Perfetto for RASP performance analysis
- Network Link Conditioner and poor-network testing
Secure development tools
- Semgrep for mobile source-code security
- CodeQL for mobile code data-flow analysis
- SonarQube in mobile security development
- Where Nuclei fits in mobile API testing
- Gitleaks for secrets in mobile repositories
- TruffleHog for secret discovery and verification
- Trivy for mobile build-environment scanning
- Grype for dependency vulnerability scanning
- Syft for software component inventories
- CycloneDX for mobile SBOM exchange
- What OWASP Dependency-Check examines
- OSV-Scanner for dependency security
- Auditing Python tooling with pip-audit
- Bandit for Python security code review
- Ruff for dependable Python analysis scripts
- pytest for mobile security helper verification
- Hypothesis for property-based Python testing
- Python cryptography for verification tools
- Requests for secure test clients
- Scapy for network protocol research
- YARA for mobile package pattern matching
- fastlane in a RASP delivery pipeline
- Gradle for Android RASP integration
- Xcode in the protected iOS build process
- GitHub Actions for mobile security gates
Protection architecture
- Application protection SDK integration architecture
- Post-build application protection
- Compiler-based RASP integration
- Protection across native and managed code
- Application protection for Flutter
- RASP for React Native applications
- Application protection for Unity games
- Kotlin Multiplatform and platform-specific RASP
- Protection for Capacitor and Cordova applications
- Designing an application protection policy engine
- Evaluating RASP signals together
- Binding integrity evidence to a transaction
- RASP verification at the API gateway
- RASP for offline applications
- Rotating mobile transaction keys
- Caching attestation results
- Securing the RASP event channel
- Feature flags for security controls
- White-box cryptography and mobile protection
- Designing secret delivery to mobile applications
- Binding evidence to JSON and Protobuf requests
- Combining RASP with server authorization
- RASP compatibility with third-party SDKs
- Secure device registration flows
- Where to place RASP checks
Production operations
- Rolling out application protection gradually
- Using RASP observation mode
- Calibrating RASP risk thresholds
- Investigating RASP false positives
- An application protection event taxonomy
- Sending RASP events to a SIEM
- A SOC runbook for application protection
- Responding to RASP incidents
- High availability for RASP verification
- Rolling back RASP policies safely
- Setting a RASP transaction latency budget
- Evaluating application protection battery use
- RASP and application startup time
- Investigating ANRs and crashes after RASP integration
- Data minimization in RASP telemetry
- Retention periods for RASP events
- User support after a RASP block
- Versioning RASP policies
- SLOs and service indicators for application protection
- Exercising a RASP service outage
- Managing RASP SDK upgrades
- Learning from application protection incidents
- Integrity of RASP test and incident evidence
- Application protection release acceptance checklist
- Total cost of application protection ownership
Standards and evidence
- Defining application protection scope with OWASP MASVS
- OWASP MASTG: planning mobile security tests
- OWASP MASWE: a common language for mobile weaknesses
- Turning a mobile security checklist into evidence
- MASVS-RESILIENCE-1: platform integrity and device signals
- MASVS-RESILIENCE-2: evidence of application integrity
- MASVS-RESILIENCE-3: measuring resistance to static analysis
- MASVS-RESILIENCE-4: resistance to dynamic analysis
- Using the OWASP Mobile Top 10
- OWASP ASVS and the mobile back end
- API Security Top 10 and application protection signals
- Building scenarios with MITRE ATT&CK Mobile
- Classifying mobile security findings with CWE
- Applying CVSS v4.0 to mobile findings
- NIST SSDF: placing RASP in secure development
- NIST CSF and application protection governance
- SLSA and mobile build provenance
- SPDX for mobile component and license inventories
- VEX: explaining whether a vulnerability affects a product
- Mobile application security in a PCI DSS context
- PCI MPoC and accepting payments on phones
- Designing RASP telemetry with KVKK in mind
- Mobile security data in a GDPR context
- ISO/IEC 27001 and managing mobile security controls
- What a SOC 2 report says about a RASP supplier
Industry use cases
- Application protection in mobile banking
- RASP for SoftPOS and mobile payment acceptance
- Application protection and key security in crypto wallets
- RASP, cheating and economy security in mobile games
- RASP for e-commerce accounts, coupons and payments
- Application protection and continuity in healthcare apps
- RASP, MDM and privacy in BYOD applications
- Application protection for public-service apps
- RASP and DRM in video and media applications
- Protecting insurance documents and claims
- RASP and delivery records in logistics apps
- Location, driver and transaction security in transport apps
- Booking and account security in travel apps
- The limits of RASP in education and exam apps
- Protecting line and account changes in telecom apps
- Application protection for IoT control apps
- Shared RASP policies in super apps
- RASP integration for fintech SDK developers
- RASP policies for offline field applications
- Where small teams should start with application protection
- Build or buy RASP controls?
- Comparing application protection, Play Integrity and App Attest
- An impartial guide to comparing application protection products
- RASP for enterprise approval applications
- Protecting loyalty points and campaigns
Android components
- Trust boundaries in Android Intent redirection
- ContentProvider access and data exposure
- Narrowly scoped file sharing with FileProvider
- BroadcastReceiver and incoming-message validation
- Bound Service security and caller authorization
- Signature-based trust with Android custom permissions
- Limiting sensitive data in the Android clipboard
- Minimizing data in Android notifications
- How scoped storage affects application data
- Document permissions with the Storage Access Framework
- Protection boundaries in Room databases
- Is DataStore a secure secrets vault?
- Checking Logcat for sensitive information
- Checking debuggable in release packages
- Reducing Android cleartext traffic exceptions
- WebView file access and local content
- Origin validation for WebView messages
- Package visibility and Android security SDKs
- Safe, usable behavior after permission denial
- Binding BiometricPrompt to a cryptographic operation
- Data boundaries between work and personal profiles
- Security in Android tasks and activity flows
- Safe paths when extracting archives
- Trust boundaries in Android data parsing
- Memory safety in Android native code
iOS data and lifecycle
- Choosing Keychain accessibility classes
- Limiting Keychain access-group sharing
- Cleaning up Keychain items on logout
- iOS keys after biometric enrollment changes
- Limits on Secure Enclave key use
- iOS file protection classes and device lock state
- Sensitive screens in the iOS app switcher
- Realistic expectations for iOS capture detection
- iOS pasteboard and sharing decisions
- Secrets and content in notification extensions
- Limiting data in iOS widgets
- Safely handling Share Extension input
- Sessions and data in iOS background transfers
- Sensitive responses in URLCache
- WKWebView cookies and web-data cleanup
- Validating custom URL schemes on iOS
- Associated Domains and application relationships
- LAContext lifetime and reauthentication
- Sensitive-data scope in iCloud synchronization
- Choosing files to exclude from iOS backups
- Personal data in iOS crash reports
- Security and data boundaries in App Clips
- Production data in TestFlight builds
- Session consistency across multiple iOS scenes
- Data surfaces in sensitive iOS text input
Network and API protection
- Preserving TLS verification in mobile clients
- Does a mobile application need certificate pinning?
- Backup pins and certificate transition planning
- mTLS and device certificates in mobile apps
- Object ownership and BOLA in mobile APIs
- API function authorization and mobile roles
- Designing mobile API rate limits
- Idempotency and mobile transaction retries
- Which fields should a mobile request signature cover?
- Canonical representation for JSON requests
- Session security for mobile WebSockets
- Field and object controls in mobile GraphQL APIs
- Security contracts for mobile gRPC clients
- DNS and certificate trust in mobile connections
- Separating enterprise proxies from mobile test inspection
- Captive portals and secure connection failures
- Cache policy for mobile API responses
- Security boundaries in mobile file uploads
- Protecting time-limited download URLs
- Pagination and bulk-data access
- Preventing information leaks in mobile API errors
- Clock skew in request verification
- Retries and backoff for security services
- Passing attestation decisions through an API gateway
- Circuit breakers for protection services
Identity and sessions
- Why mobile OAuth uses PKCE
- Using the system browser for mobile sign-in
- Registering OAuth redirect URIs securely
- ID tokens versus access tokens
- Rotating mobile refresh tokens
- Revoking mobile sessions remotely
- Protecting Android passkey integration
- iOS passkeys and application identity
- Recovery policies for passkey accounts
- Step-up verification for sensitive transactions
- Device binding and account registration
- What DPoP adds to mobile access tokens
- Validating JWT claims in mobile APIs
- Where to store mobile access tokens
- Is local biometrics proof of identity to a server?
- SMS codes and mobile account security
- Time and recovery in TOTP flows
- Unintended approval in push authentication
- Protecting mobile password reset
- Support-team authority in account recovery
- Idle timeouts in mobile sessions
- Separating multiple mobile accounts safely
- Combining risk signals with authentication
- Separating login from transaction authorization
- Account deletion and security-data lifecycle
Keys and cryptography
- Authenticated encryption for mobile data
- Nonce discipline with AES-GCM
- When to consider ChaCha20-Poly1305
- Nonce, IV and challenge: different requirements
- Cryptographically secure randomness on mobile
- Context separation in HKDF key derivation
- Choosing cost for password-based key derivation
- HMAC, message integrity and shared secrets
- Digital signatures versus encryption
- What JWS and JWE provide in mobile protocols
- Envelope encryption for mobile data
- Key versions and older encrypted data
- Recovery after mobile key invalidation
- Reducing the lifetime of secrets in memory
- What a file hash establishes
- Constant-time APIs for secret comparisons
- Questions to ask when buying white-box cryptography
- Developing iOS cryptography with CryptoKit
- What Tink offers mobile projects
- Using libsodium securely in mobile applications
- Local database encryption with SQLCipher
- Verification with cryptographic test vectors
- Cryptographic agility and data formats
- Responding to mobile key exposure
- KMS and HSM roles in mobile architectures
Build and distribution
- Android upload keys and app signing keys
- APK signature schemes and verification scope
- Protection compatibility during Android signing-key rotation
- Protection coverage in split APK distribution
- Security controls in dynamic feature modules
- Android ABI coverage and protection tests
- Android page-size compatibility for security SDKs
- iOS provisioning and protection configuration
- Comparing iOS distribution entitlements
- Symbol archives for protected iOS releases
- Reproducibility in mobile builds
- Locking dependencies in mobile projects
- Verifying downloaded build dependencies
- Binding a mobile SBOM to a release
- Sigstore and mobile artifact provenance
- What belongs in mobile build provenance?
- Signing secrets in mobile CI pipelines
- Separation of duties in mobile release approval
- Artifact checksums for FTP and store delivery
- Data compatibility when rolling back mobile releases
- Ending support for older mobile versions safely
- Package identity and environment separation
- Build flags and security features
- Updating privacy disclosures after SDK changes
- A pre-release security evidence package
ASO and store trust
- The relationship between app protection and ASO
- Security claims in store descriptions
- Security keywords in application names
- Planning App Store keywords
- Explaining protection in a Google Play short description
- A security section in a long store description
- Security messaging in store screenshots
- Sensitive data in application preview videos
- Trust and brand consistency in app icons
- App Store privacy details and protection SDKs
- Google Play Data safety and app protection
- Explaining security SDKs to users
- Aligning permission prompts with store promises
- Do security features improve store rankings?
- Protection SDKs, ANRs and store experience
- Responding to security complaints in store reviews
- How protection blocks affect user trust
- Localizing security terms for store listings
- Security-focused custom product pages
- Testing security messaging on App Store product pages
- Security messaging in Google Play listing experiments
- Are web SEO and ASO the same work?
- Avoiding unnecessary data in ASO measurement
- Security badges and certification claims in stores
- Security questions on store support pages
Comparison and selection
- Comparing Android app protection and iOS app protection
- SDK integration or post-build protection?
- Protection coverage in native and cross-platform apps
- Choosing obfuscation and runtime protection together
- Root detection versus platform attestation
- Pinning and attestation answer different questions
- Device binding versus fingerprinting
- Comparing free and commercial protection
- Selecting an open-source security library
- Cloud verification versus self-hosted operation
- Selecting protection for offline applications
- Planning an exit from a protection supplier
- Evaluating minimum operating-system support
- A realistic protection integration schedule
- Fair performance comparisons of protection products
- Calculating false-positive rates correctly
- Alarm counts or prevented business risk?
- Scoping an app protection penetration test
- Limits of automated protection assessments
- Measurable evidence in a proof-of-concept report
- Technical questions for an app protection RFP
- Data and access questions for supplier telemetry
- Emergency update capacity in protection products
- A total-cost model for app protection
- A weighted decision matrix for protection products