mobile-security

• SKILL.mdcore · 7,568 bytes
• SKILL.mdcore · 7,568 bytes
• metadata.jsonasset · 1,657 bytes
• references/platform-specifics.mddoc · 5,691 bytes
• references/verifying-findings.mddoc · 4,191 bytes

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/mobile-security/SKILL.md. -->

# Mobile Application Security

Android and iOS hardening on a device you do not control: hardware-backed credential storage, exported components and IPC, verified deep links, transport defaults and pinning rotation, server-side attestation over client-side root detection, screen capture, and release-build hygiene — including React Native and Flutter packaging. Use when generating Android or iOS app code, manifests, or native modules, wiring deep links or WebViews, or deciding what a mobile client is trusted to assert.

## ALWAYS

- Start from the premise that **the device belongs to whoever is holding it**. The app runs on hardware an attacker can root or jailbreak, instrument at runtime, and read at rest. Everything shipped in the package is extractable, every client-side check is removable, and every local check can be made to return the answer the attacker wants. What you actually control is the backend's willingness to act — so any decision that matters is made server-side, on evidence the server verified.
- Issue short-lived, device-scoped tokens from a backend rather than shipping an API key, signing key, or backend credential in source, resources, `strings.xml`, `BuildConfig`, or `Info.plist`. Anyone can download the package and read it.
- Keep credentials in the platform's hardware-backed store: Android Keystore (`EncryptedSharedPreferences` with a `MasterKey`), iOS Keychain with a `…ThisDeviceOnly` accessibility class — `WhenUnlocked` where the value is never needed in the background, `AfterFirstUnlock` where it is. Never `SharedPreferences`, `UserDefaults`, a plist, or a file. The store protects a key at rest on an uncompromised device; it does not protect against code running inside your process, which is why the credential should be short-lived regardless.
- **Android**: give every `<activity>`, `<service>`, `<receiver>` and `<provider>` an explicit `android:exported`, defaulting to `false`. Since API 31 the attribute is mandatory when an intent filter is present — which forces the question to be asked, not answered. An exported component is a public API of your app that any installed application can call.
- Treat data crossing an app boundary as untrusted in both directions: validate every `Intent` extra and incoming activity payload, send sensitive data with an explicit component rather than an implicit intent any app can register for, and create every `PendingIntent` as `FLAG_IMMUTABLE` so the recipient cannot rewrite its contents.