Securing Mobile Apps: An OWASP Mobile Top 10 Field Guide
Practical defaults for building fintech-grade mobile apps — assuming the device is hostile.
Shipping a fintech app means assuming the device is hostile. The OWASP Mobile Top 10 is a practical checklist I work through on every release, not a one-time audit.
Start with data at rest: never store secrets or tokens in plain SharedPreferences. Use the platform keystore/keychain via secure storage, and keep nothing sensitive you do not strictly need. Validate and sanitize all input server-side — the client is a convenience, not a trust boundary.
Protect data in transit with TLS and, for high-value apps, certificate pinning so a compromised network cannot man-in-the-middle your API. Pair it with short-lived tokens and a real session lifecycle: refresh, revoke, and log-out-all-devices.
Add tamper and integrity checks where the threat model warrants it, lock down deep links and exported components, and require biometric or PIN re-authentication for sensitive actions. Keep dependencies scanned and patched — most mobile breaches are old CVEs, not novel attacks.
Security is not a feature you bolt on at the end; it is a set of defaults. Bake them into your project template so every new screen and endpoint starts safe.