Android app for clients: How do we know if the developer actually wrote secure code?

Ask the developer this simple question: 'If a user opens this app on a rooted phone or if I inspect the network traffic through a proxy can I see client session tokens?' If they dodge the question the security layer is weak. You can also install the app on a test device and run the APK file through free open-source vulnerability scanners yourself to check the basics.

Where is the backend server (API) hosted and who audited its security? With mobile apps data leaks rarely happen from the phone itself; they usually come from broken authorization flaws on the backend server the app pulls data from. Has the API security been tested?

If you are storing clinic data and commercial orders in Germany, you are required by DSGVO to document the 'privacy by design' principle. Ask the developer to fill out an OWASP Mobile Application Security Verification Standard (MASVS) compliance checklist. Have them write down what measure they took for each item and sign off on it. You'll quickly see whether they are willing to take official responsibility.

Developers saying 'everything is secure' means absolutely nothing. Most freelancers just copy-paste ready-made code snippets from the internet and hardcode API keys right into them as plaintext. Never believe an app is secure unless an independent pair of eyes has reviewed it from the outside.

first thing check app permissions in phone settings. if an app that just takes orders wants access to files, location or contacts it means the dev just copy-pasted a template and moved on. unnecessary permissions are the biggest risk.

Doesnt the Google Play Store already run security checks when apps are uploaded anyway? If the store approved it, do we still have to get extra security testing done?

We took delivery of a similar B2B app last year. The developers sounded super confident, but we paid 2.500 EUR to have an independent mobile pentest done. The report revealed that backend server passwords were left completely exposed inside the APK and session tokens never expired. If we hadn't paid that money, we would've faced a massive scandal.

The cheap-looking path usually ends up costing more later. An untested backup is not a backup.

i think differently. if it's your first time, start small; scaling comes later.

provn by experience.

The opposite happened to me, that's why I'm writing. If you get three different answers on a topic, the question was asked wrong.

If you post the result here, it will help others too.

just a heads-up. like don't rely on a single measure; go layer by layer.

if you post the result here, it will help others too.

I agree.

youre right Ive been down that road too. dont hesitate to ask; those who dont ask always pay more.

My questions are cleared up, thanks. If 2FA is on, a stolen password alone is useless.

The real issue isn't the number, but what it's based on.

You're right. Your time to detect an issue directly determines its cost.

There's one point I'm curious about. When making decisions, write down the worst-case scenario too, not just the best.

That's all, sorry if I went on too long.

I didn't know that. If 2FA is on, a stolen password alone is useless.

Let me summarize what's been said so far. If it's your first time start small; scaling comes later.

Good luck with that.