Skip to content
Qubitron Security

Mobile app security testing for Android and iOS

We decompile your build, run it instrumented on real devices, and test the backend behind it, for Android, iOS or both.

  • Android (APK and AAB)
  • iOS (IPA)
  • React Native and Flutter
  • Backend APIs the app calls

What it is

A mobile app is a client you hand to the attacker. Anyone can download your build, decompile it, patch it, run it on a rooted or jailbroken device and watch every request it makes. We test what that reveals and what it allows.

The engagement follows the OWASP Mobile Application Security Verification Standard (MASVS) and combines static analysis of the build with dynamic testing on instrumented devices, plus testing of the API the app depends on.

What we check

  • Reverse engineering resistance: what the decompiled app reveals about logic, endpoints, keys and feature gates, and how easily it can be repackaged.
  • Local storage: credentials, tokens and personal data in preferences, databases, caches, logs and backups.
  • Network security: certificate pinning, TLS configuration, cleartext traffic and what an attacker on the same network can intercept or modify.
  • Authentication and session handling, including biometric and device-binding flows and token storage.
  • Platform interaction: exported components, deep links, intents, clipboard, screenshots and inter-process communication.
  • Runtime integrity: root and jailbreak detection, debugger detection, hooking resistance and tamper response.
  • The backend: the same API checks as a web penetration test, scoped to what the app calls.

What you receive

  • A report per platform, mapped to MASVS controls, with severity, evidence and remediation for each finding.
  • Decompiled and runtime evidence: extracted values, captured traffic and the exact code paths involved.
  • A hardening plan specific to your stack (native, React Native or Flutter).
  • A re-test of fixed findings and an updated report.

Typical timeline

2 to 3 weeks per platform

Android and iOS can run in parallel when both are in scope.

Pricing

Quoted for your app

Discussed on a short call, then a fixed price in writing before anything starts. Request a quote

Who it's for

  • Fintech, health and marketplace apps that store or move sensitive data.
  • Apps with paid features, licensing or in-app logic worth protecting from cracked builds and clones.
  • Teams preparing for app store review escalations, partner audits or compliance.

Next step

Tell us about the app. We discuss scope and price on a short call, then send a fixed quote in writing.

Request a quoteBook a free exposure call

We only test applications you own or are explicitly authorized to test.

How quoting works

  1. Tell us about the app

    Platform, roughly how big it is and what you are worried about. Two minutes on the form.

  2. Scoping call

    A short call with an engineer to agree what is in scope, what is out, and when. Pricing is discussed here.

  3. Written proposal

    A fixed price, timeline, deliverables and rules of engagement in writing. You sign, we schedule.

Common questions

Do you test Android and iOS separately?

Yes. Each platform's build, storage and runtime protections differ, so each gets its own testing and report. Both can run in parallel.

Can you test React Native and Flutter apps?

Yes. Cross-platform apps ship their logic in a JavaScript bundle or a compiled Dart snapshot, and we test what each reveals, plus the native layer around it.

Which standard do you follow?

The OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Top 10. Findings in the report are mapped to MASVS controls.

Further reading

Often paired with

All services

Next step

Find out what your app gives away. Book a free exposure call.

Thirty minutes with an engineer, not a sales deck. Tell us what you ship; we tell you what we'd look at first and what an audit would involve.

Book a free exposure callRequest an audit

We only test applications you own or are explicitly authorized to test.