Security testing
Mobile app penetration testing
A mobile app runs on a device you don't control. I test what an attacker could do with it: read data stored on the phone, intercept or alter its traffic, bypass its client-side checks and attack the APIs behind it.
Quoted individually, based on the scope.
What's included
- Data stored on the device and in logs.
- Communication with the server and certificate validation.
- Authentication, sessions and local checks that can be bypassed.
- The APIs the app uses.
What you get
- A written report with each finding, its CVSS v4.0 severity, how to reproduce it and how to fix it.
- An executive summary for non-technical stakeholders.
- A call to walk your team through the results.
- A re-test of the fixed findings at no extra cost, within 90 days of the report.
Who it's for
- Apps that handle personal, health or financial data.
- Apps nearing release or just after a major update.
Not included
- Testing apps or devices without written authorization from their owner.
- Attacks on app stores or on other users.
Process
How I work
-
Scope and authorization
We define what to test, how and when. Nothing starts without your written authorization.
-
Testing
Manual testing and review, supported by tools. If I find something critical, I tell you right away.
-
Report
You get every finding rated with CVSS v4.0, with the steps to reproduce it and the recommended fix.
-
Follow-up
I walk your team through the results and re-test the fixes at no extra cost, if you request it within 90 days of the report.
Frequently asked questions
Android, iOS or both?
Either or both. We define it in the scope, along with the versions and devices to test.
Other services
- Web and API penetration testing Manual testing of web applications and APIs, the way an attacker would approach them.
- Cloud penetration testing (AWS) Testing and configuration review of AWS environments: permissions, exposure and secrets.
- Vulnerability assessment A broad review of your exposure, with risks ranked so you know what to fix first.
- Secure code review A review of your code to find vulnerabilities before they reach production.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.