Mobile App Security skill for Codex

Done well means: every MASVS control group was checked against the code and the built artifact (not only one of them), each finding names the file or manifest line plus the MASVS control it maps to, and the client is never trusted to enforce anything the server must enforce. A mobile app is a binary the attacker owns; review it with that assumption.

Scope and setup

• Confirm what is in scope: source repo, a release build (.ipa/.aab/.apk), backend APIs. Dynamic testing (Frida, objection, proxying a device) requires written authorization from the app owner and a test device or emulator, never a user’s phone.
• Read AGENTS.md, then identify the stack: native (Swift/Kotlin), React Native, Flutter, Capacitor. Cross-platform apps have two layers to review: the JS/Dart code and the native config (Info.plist, AndroidManifest.xml, entitlements, Gradle).
• Pick the MAS testing profile with the owner: L1 (baseline, every app), L2 (apps handling sensitive data such as health, finance, identity), R (resilience against reverse engineering, only when the business model needs it).

Tools (installs need network; ask for approval in the Codex sandbox):

jadx -d out/jadx app-release.apk          # decompile to Java/Kotlin-ish source
apktool d app-release.apk -o out/apktool  # decoded manifest and resources
bundletool build-apks --bundle=app.aab --output=app.apks --mode=universal  # aab -> apk
apksigner verify --print-certs app-release.apk
unzip -q App.ipa -d out/ipa && plutil -p out/ipa/Payload/*.app/Info.plist
codesign -d --entitlements - out/ipa/Payload/*.app
docker run --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf  # MobSF static scan UI

Review by MASVS group

Group	Check	Red flag
STORAGE	Where tokens, PII and caches live	Tokens in UserDefaults, SharedPreferences, AsyncStorage, SQLite or files without protection; sensitive data in logs or screenshots
CRYPTO	Keys and algorithms	Hardcoded keys or IVs, ECB, MD5/SHA-1 for security, custom crypto
AUTH	Session and local auth	Biometric check that only gates UI (boolean) instead of unlocking a Keychain/Keystore key; long-lived tokens with no server-side revocation
NETWORK	Transport	NSAllowsArbitraryLoads, usesCleartextTraffic="true", user CAs trusted in release, disabled hostname verification
PLATFORM	IPC, WebViews, deep links	Exported activities/receivers/providers without permissions; addJavascriptInterface on remote content; deep-link params used unvalidated
CODE	Build and dependencies	debuggable release, outdated SDKs, vulnerable third-party libraries, no minimum OS policy
RESILIENCE	Anti-tampering (profile R only)	Relying on root/jailbreak detection as a security control
PRIVACY	Data minimisation	SDKs collecting more than declared in the privacy manifest or Data safety form

Grep pass over source

rg -n "UserDefaults|NSUserDefaults|kSecAttrAccessibleAlways|SharedPreferences|AsyncStorage|MMKV" src ios android lib
rg -n "allowBackup|usesCleartextTraffic|exported=\"true\"|debuggable|networkSecurityConfig" android
rg -n "NSAllowsArbitraryLoads|NSExceptionDomains|LSApplicationQueriesSchemes" ios
rg -n "setJavaScriptEnabled|addJavascriptInterface|setAllowFileAccess|WKWebView|evaluateJavascript" .
rg -n -i "api[_-]?key|secret|BEGIN (RSA|EC) PRIVATE|firebase.*key" --glob '!**/node_modules/**' .
rg -n "X509TrustManager|checkServerTrusted|ALLOW_ALL_HOSTNAME|HostnameVerifier" android

Platform rules

Android

• Since Android 12 every component with an intent filter must declare android:exported. Anything exported="true" must validate its input and, if not meant for other apps, be set to false or protected with a signature permission.
• Use a network_security_config.xml that trusts only system CAs in release; user CAs only inside <debug-overrides>.
• Store secrets with keys from the Android Keystore (setUserAuthenticationRequired for biometric-gated keys). The Jetpack Security crypto library (EncryptedSharedPreferences) is deprecated; prefer Keystore-backed keys with DataStore, or Tink.
• android:allowBackup="true" (default) copies app data into cloud and device backups. Set dataExtractionRules (Android 12+) and fullBackupContent to exclude tokens and databases.
• FLAG_SECURE on screens that show secrets or one-time codes.

iOS

• Keychain items use kSecAttrAccessibleWhenUnlockedThisDeviceOnly (or AfterFirstUnlock... ThisDeviceOnly for background refresh). Never kSecAttrAccessibleAlways.
• Files with sensitive content use Data Protection .completeFileProtection.
• ATS exceptions must be narrow (NSExceptionDomains for one host with a reason), never NSAllowsArbitraryLoads in a release build.
• Universal links over custom URL schemes for anything carrying tokens; any app can claim a custom scheme.
• Hide sensitive views when the app moves to background (snapshot in the app switcher).

Cross-platform

• React Native: AsyncStorage is plaintext. Use react-native-keychain or expo-secure-store. Check that release bundles do not ship source maps or .env values (anything in EXPO_PUBLIC_* or react-native-config is in the binary).
• Flutter: shared_preferences is plaintext; use flutter_secure_storage. Release builds with --obfuscate --split-debug-info only if profile R applies; obfuscation is not a security boundary.

Hard rules

• Any key, API secret or signing material in the app is public. If the code needs a secret to call a third-party API, move that call behind your backend.
• Root/jailbreak detection, pinning and obfuscation raise cost; they never replace server-side authorization. Every authorization finding is fixed on the server.
• Certificate pinning needs a backup pin and a rollout plan. Pinning to a leaf that rotates bricks the installed base; pin to the SPKI of an intermediate or your own CA, with a remote kill switch.
• App attestation (Play Integrity API, App Attest) is a risk signal for the backend, not a gate the client checks itself.
• Do not publish, upload to public scanners or share the client’s binary or findings outside the engagement without explicit permission.

Verification

• Rebuild the release variant and rerun the manifest and plist checks against the built artifact, not the source tree; build flavors often override manifests.
• Re-scan with MobSF and compare against the first run.
• For storage fixes, install on an emulator, log in, then inspect the sandbox (adb shell run-as <pkg> ls -R on debuggable test builds; on iOS, the simulator’s ~/Library/Developer/CoreSimulator/Devices/.../data/Containers/Data/Application/). Tokens must not appear in plaintext.
• For network fixes, proxy a test device through an intercepting proxy with a user CA: a release build must refuse the connection.

Output template

## Mobile security review: Acme Wallet 4.2.0 (iOS 4.2.0 build 311, Android 4.2.0 vc 4200)
Profile: MAS-L2 | Scope: source @ a1b2c3d, release builds, /v2 API | Dynamic tests: emulator only

| ID | MASVS | Severity | Finding | Location | Fix |
|---|---|---|---|---|---|
| M-01 | STORAGE | High | Refresh token in AsyncStorage | src/auth/session.ts:42 | Move to react-native-keychain, WhenUnlockedThisDeviceOnly |
| M-02 | PLATFORM | Medium | Exported DeepLinkActivity passes `url` to WebView unvalidated | AndroidManifest.xml:88, DeepLinkActivity.kt:31 | Allowlist hosts; exported=false for internal routes |

Not tested: RESILIENCE (profile R out of scope); backend authz beyond /v2/wallet.