Can we do mobile app security testing ourselves for free without paying an agency?

First thing you should do is search your source code to see if any passwords, secret keys, or database connection strings were accidentally left behind. Free code scanners can spot those in seconds.

Most real vulnerabilities in mobile apps aren't on the client side, they're in the backend services. Try changing the user ID and fetching another salon's appointments; no automated free tool is going to catch those logic flaws on its own.

We ran tests with an open-source static tool on our first release and found a test token accidentally left in one of our libraries. It saved us from a critical leak before going live, without spending a dime.

Don't upload your app package directly to those so-called 'free online security scan' websites. Handing your proprietary code over to third-party sites introduces a whole new security risk.

Do these free tools also check for OS-level vulnerabilities on the phone or do they only look at the code we wrote?

Correction: I misremembered the figure, it was a bit lower.

They only look at your app package and how it communicates with your server. OS patches on the phone are the manufacturer's responsibility; mobile testing is just about evaluating the security of your app.

Someone I know had an app where booking IDs were sequential and a user just incremented the number in the URL and dumped the entire salon's customer list. It takes a watchful human to spot business logic flaws like that, not automated tools.

check your github history too sometimes even if u delete stuff from the code api keys are sitting right there in old commits.

We need to take it step by step. If it's your first time, start small; scaling comes later.

If 2FA is on, a stolen password alone is useless. Just leaving this note it might be useful.

Do you think this works at any scale? Taking measures without an inventory leaves doors you haven't seen open.

Of course, it varies if your situation is different.

I went through the same thing. People defend habits, not processes. Resistance comes from there.

Correct me if Im wrong.

the opposite happened to me, that's why I'm writing.. and hasty decisions become decisions you have to fix six moonths later.

I think its hard to be that definitive about mobile app security testing. The answer varies greatly by industry; there is no one-size-fits-all rule.

Thats all sorry if I went on too long.

greaat work.

Let me summarize the topic since several different answers were given. Most time waste accumulates in tasks waiting for approval.

Start with a small trial; don't commit to everything at once.

If I understood correctly, you're saying: If 2FA is on, a stolen password alone is useless.

I'm also curious if anyone does it differently.

this thread is archived.

Thanks for posting.