My mobile app has passwords, tokens, and API keys — can it be reverse-engineered?

dont hard-code api keys. keep them on the server request a token from the app. use certificate pinning (to prevent MITM). use keystore/keychain for sensitive data. obfuscate the apk with proguard. add root/jailbreak checks...

Mobile security implementation: 1) AndroidKeyStore: KeyStore.getInstance('AndroidKeyStore'), key generation with encryption, 2) iOS Keychain: SecItemAdd() for secure storage, 3) API auth: OAuth token refresh (expires in 1 hour, issued by server), 4) Certificate pinning (TrustKit iOS, Network Security Configuration Android), 5) Obfuscation (ProGuard rules: protect API classes, obfuscate others), 6) Runtime checks (RootBeer Android, DTTJailbreakDetection iOS), 7) Frida hardening (anti-hook detection: verify API function signatures). Storage hierarchy: Public (none), Local (encrypted), Keychain/Keystore (hardware-backed if available). Pen testing tools: Burp Suite mobile proxy, Frida interactive instrumentation, APK decompiler (apktool, dex2jar), debugger (gdb on Android, lldb on iOS).

don't hardcode API keys, keep them on the server but app login → server sends token → client caches it. token expires in 1-4 hours. use keystore/keychain for data storage. obfuscate with proguard. add jailbreak/root checks, close the app if detected...

Mobile app security layers: Network (TLS 1.2+, cert pinning), API (token-based auth OAuth short-lived tokens), Storage (encrypted keystore), Code (obfuscation anti-tampering), Runtime (jailbreak/root detection). Threat model: physical access (rooted device debugger), network access (proxy intercept — blocked by cert pinning) code analysis (reverse engineering — mitigated by obfuscation). OWASP Mobile Top 10: insecure transmission (prevent TLS bypass) insecure storage (keystore encryption), insecure auth (OAuth best practices), weak cryptography (AES-256), client-side injection (input validation).

Let me clarify the technical side. When we decide without measuring, we always end up in the same place.

I'm also curious if anyone does it differently.

Same here.

I'd say don't rush. I mean when we decide without measuring we always end up in the same place.

That's all, sorry if I went on too long.

My questions are cleared up thanks.

There's a trap here, let me mention it. If permission and scope aren't in writing, don't start that test.

Don't rely on a single measure; go layer by layer.

I have a question. When you try to change everything at once, nothing settles.

Hope this helps.

I'm in the same situation that's why I'm asking. If permission and scope aren't in writing, don't start that test.

Thanks a lot, I'll try it today. Mistakes made on the mobile app security side are usually reversible but expensive.

Saved. The harder it is to reverse a decision, the slower you should make it.

Mistakes made on the mobile app security side are usually reversible but expensive.

I didn't know that.

I'm curious too. Most time waste accumulates in tasks waiting for approval.

If you post the result here, it will help others too.

My question might sound amateurish, sorry about that. Having backups accessible on the same network and with the same identity makes them part of the target.

Payment information changes are never verified through the channel they came from. If I were you, I'd go this route.

Noted, thanks. If it's your first time, start small; scaling comes later.

Correct me if I'm wrong.

This thread is archived. Payment information changes are never verified through the channel they came from.

Correct me if I'm wrong.