How do you secure a mobile app, and what pre-launch checks are absolute musts?

If you're using JWTs, keep token lifespans very short—like 15 minutes for access tokens and 7 days for refresh tokens. Also, make sure no `.env` file gets bundled into the build artifact. Devs sometimes accidentally leave staging database credentials or third-party API keys right in the client code.

Pre-launch priority items: 1) Add root/jailbreak detection to flag modified devices. 2) Block screenshots and blur the app switcher preview when backgrounded. 3) Suppress server paths and raw database logs from error responses.

You can test this right now: install a network packet capture tool on your PC, connect your phone to the same Wi-Fi, and route traffic through your computer. If you can read wholesale pricing and invoice details in plain text on your monitor SSL pinning isn't in place.

People obsess over locking down the mobile client and forget the real front door: the API. Even if you turn your mobile app into an impenetrable fortress, an attacker won't bother using it; they'll just hit your API endpoints directly. Never treat the mobile client as a trusted environment—all validation logic belongs on the server.

We ran into this exact issue last year on a B2B wholesale app. A dealer intercepted the request while placing an order and sent a unit price of 15 TL instead of 150 TL to the API. The price field was locked on our mobile screen, but our backend blindly accepted the incoming price. We only caught it two weeks later during inventory counts. Double-check all server-side price validations.

dont forget to disable debug logs user data and tokens can leak straight into logcat clear all console logs before pushing to stores.

Since your application stores financial data that qualifies as commercial trade secrets for corporations and sole proprietorships, any potential leak triggers a mandatory data breach notification to the Kişisel Verileri Koruma Kurumu under KVKK regulations. Documenting and maintaining your data security protocols is a strict legal necessity.

wait so with this reverse engineering thing, dealers or anyone else can just download the app and inspect our entire source code on their computer? doesnt the app store review process block that?

Correct.

Thanks this was very helpful.

Don't miss this: When you try to change everything at once, nothing settles.

Just leaving this note, it might be useful.

Let me share what happened to me; it might be useful. Hasty decisions become decisions you have to fix six months later.

i diddnt know that.

Here's how it went for us. Trying to do this alone is the most expensive way.

Hope this helps.

there are three things to check when doing this but securitty isn't absolute; it's about making attacks not worth the effort.

don't hesitate to ask; those who don't ask always pay more. i mean if I were you, I'd go this route.

I've been down this road, let me tell you. Security isn't absolute; it's about making attacks not worth the effort.

Correct me if I'm wrong.

Don't miss this: Just because everyone does it doesn't mean it's right.

Forgotten test environments are more often the entry point than live systems.

The answer above hits the nail on the head. Solutions that work at a small scale collapse when you grow; I learned this late.

People defend habits, not processes. Resistance comes from there. That's all, sorry if I went on too long.