Overview
For most Indian businesses the mobile app is the main channel rather than an extra one, and Android is the platform most customers carry. That brings a wide spread of handsets and OS versions, repackaged clones and phones shared within a family. We test Android and iOS builds against OWASP MASVS, paying close attention to device binding, SMS and OTP handling and the backend APIs the app relies on. Each platform is scoped and priced separately in INR.
A mobile application ships to devices that may be jailbroken, rooted, stolen or running a hostile proxy, so the assumptions a web app can make no longer hold. We test what the app stores on the device, how it protects that data at rest, and whether an attacker with physical or network access can recover credentials, tokens or personal data from files, databases, logs or the keychain and keystore.
We examine the app in motion as well as at rest. That means inspecting transport security and certificate validation, attempting to intercept and modify traffic, and checking platform-specific weaknesses: exported components and deep links on Android, inter-process URL handling on iOS, and insecure use of WebViews on both. Where client-side controls such as root detection or certificate pinning exist, we assess how much real protection they add.
Because most of a mobile app's value lives in its backend, the APIs it calls are in scope by default. A hardened client is of little use if its server trusts any request, so we carry the authorisation and logic testing through to the service behind the app. Findings are aligned to the MASVS, scored with CVSS v4.0, and written so your mobile and backend teams each know what to change.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Build intakeWe take your IPA or APK and the test accounts needed for each role and platform.
- Static reviewWe unpack and inspect the build for secrets, configuration and insecure components.
- Dynamic testingOn real devices we exercise storage, transport, platform and runtime behaviour.
- Backend testingThe APIs the app calls are tested for authorisation and logic flaws.
- Report & debriefFindings are evidenced, scored and explained to your mobile and server teams.
What you receive
- Per-platform findings aligned to the OWASP MASVS
- Static and dynamic evidence for each issue
- CVSS v4.0 scores and prioritised remediation
- Backend API findings where in scope
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP MASVS
- OWASP MASTG
- OWASP API Security Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
- DPDP Act 2023
- RBI IT Governance Direction 2023
Frequently asked questions
Do you need the source code?
No. We can test a compiled IPA or APK as a grey-box engagement using test accounts. Source or build access speeds up static review and improves coverage, so we welcome it where you can share it, but it is not a requirement.
Do you test on real devices or emulators?
Both. Emulators are useful for repeatable static and dynamic checks, but some platform and hardware behaviour only appears on physical handsets, so we confirm key findings on real rooted and jailbroken devices across the versions you support.
Is the backend included or priced separately?
The APIs the app relies on are part of a meaningful mobile test, so we include authorisation and logic testing of them by default. A very large backend with many unrelated services may be scoped as its own API engagement, which we confirm before we start.
Do you quote in rupees, and is GST extra?
Yes to both. Proposals are fixed-price in INR, and 18% GST is added on the invoice. The figure covers testing, the report, a debrief call and a retest of the findings you fix.
Can this report go to our RBI or SEBI auditor?
Reports show scope, dates, method, CVSS-rated findings and closure status, which is what auditors normally look for. If a regulator or contract insists on a CERT-In empanelled auditor, note that we do not claim empanelment; raise it when we scope the work and you will get a clear yes or no on whether we can meet it.