Mobile app security testing in India (Android & iOS)

Many “mobile-only” scanner reports miss the issues that actually lead to account takeover or tenant data exposure — those live in the API. PoCForge prefers scopes that include the mobile client and the authenticated API surface the app uses. See also API security testing in India and the canonical mobile application penetration testing page.

Good fit: product companies shipping Android/iOS apps to Indian or international users; teams preparing for enterprise security reviews; startups that need clear evidence for customer questionnaires.

May need a different procurement path: regulated programmes that contractually require a CERT-In empanelled auditor — verify the official list and read our CERT-In decision guide.

B2B SaaS companion app. Enterprise customers ask whether mobile sessions and cached data are safe on shared devices. Testing focuses on local storage, logout/revocation and API authorisation for the same tenants used on web.

Consumer app before a major release. Teams want a focused pass on authentication, deep links and the highest-value API flows before store submission or a marketing push.

Fintech-adjacent product. Even when payments are handled by a provider, session handling, device binding assumptions and data exports still deserve adversarial review. Scope carefully; we will not over-claim coverage of systems outside your control.

• Platforms (Android, iOS, or both) and distribution channel
• Build type you can supply (release, internal, debug) and signing constraints
• Whether rooted/jailbroken device testing is authorised
• Test accounts across roles and tenants
• Whether the same API is already covered under a web+API engagement
• Any third-party SDKs that handle auth or sensitive data

We do not promise “zero vulnerabilities”, unlimited retests, or coverage of every SDK dependency on earth. Physical device theft scenarios, advanced hardware attacks and unbounded source-code audits are out of scope unless explicitly agreed. Clear boundaries make reports more useful.

Prioritise issues that enable account takeover, access to other users’ data, long-lived credential theft from device storage, or trivial bypass of client-side-only controls that the API fails to enforce. Cosmetic hardening notes still help, but they should not drown the report. Ask vendors how they triage — “count of findings” is a weak quality metric.

Mobile findings often require coordinated fixes: client storage changes plus API authorisation hardening. We structure reports so owners are obvious, and we encourage joint triage calls when both teams attend. That reduces the common failure mode where a client “fix” leaves the API still wide open.

Large delivery factories can be the right fit for some procurement programmes. Boutique testing suits product companies that want senior attention on their specific architecture, clearer writing, and careful scoping. PoCForge is intentionally small: we publish prices, decline work that is a poor fit, and focus on validated impact. If you need a global brand stamp more than depth, say so — we would rather redirect you than oversell.