OWASP Mobile Top 10 (2024)

Hardcoded API keys, tokens, or credentials embedded in the app binary or config, plus insecure handling of credentials at runtime (logging, caching, or storing them insecurely on the device).

Vulnerable or tampered third-party SDKs, libraries, and build tooling pulled into the mobile app, plus insecure build/release pipelines that let a compromised dependency reach production.

Authentication and authorization performed client-side, weak or bypassable biometric checks, or server-side APIs that trust the mobile client instead of enforcing authorization on every request.

Missing or weak validation of input from the network, deep links, IPC, or the user, and of output passed to native code, web views, or backend APIs.

Network traffic sent without TLS, with weak cipher suites, or without certificate/public-key pinning, allowing interception or tampering in transit.

Collection, retention, or third-party sharing of personal data beyond what the app discloses to the user, including data harvested by embedded SDKs.

Missing anti-tampering, anti-debugging, obfuscation, or root/jailbreak detection, making the app easy to reverse engineer, patch, or repackage.

Insecure default permissions, exported components, backup settings, or backend configuration that widen the app's attack surface beyond what is necessary.

Sensitive data written to local storage, shared preferences, logs, caches, or backups without encryption, retrievable from a lost, stolen, or rooted device.

Weak, broken, or misused cryptographic algorithms and key management, or encoding mistaken for encryption, leaving protected data effectively exposed.