Mobile Application
Security Testing

Mobile application security testing (sometimes called mobile VAPT or MAST) is a structured assessment where certified experts test iOS and Android apps for vulnerabilities. It covers binary hardening, local data storage, certificate pinning, deep-link handling, IPC, biometric flows, and the backend APIs the app talks to. It goes beyond automated scanning to include manual reverse engineering and mobile-specific business-logic abuse.

Both. Most engagements cover the iOS and Android variants of the same app together — they share the same backend but have very different attack surfaces (Keychain vs Keystore, ATS vs Network Security Config, intent system vs URL schemes). We assemble platform-specific auditors per engagement.

For full-fidelity testing, yes — we use jailbroken iOS devices and rooted Android devices in our lab so we can inspect Keychain entries, attach debuggers, and bypass certificate pinning under controlled conditions. For black-box constraints, we can also exercise the app on stock devices for production-realistic attack scenarios.

Configurable per engagement. Black-box means production binaries only — closest to a real attacker. Grey-box adds a test account and architecture overview. White-box includes source code review alongside binary testing — recommended when you can share, since it speeds up verification and produces sharper remediation guidance.

A typical single-platform engagement runs 6 to 10 business days end-to-end (kickoff, binary analysis, manual testing, dynamic instrumentation, three-layer QA, reporting). iOS + Android together is usually 10 to 14 business days. Lemon enforces daily progress tracking so you always know where it stands.

For banks: the RBI Directions, 2026 place internet-facing mobile applications inside lifecycle VA/PT at paragraph 150 — pre-implementation, post-implementation and after changes — and set the cadence at paragraph 151, vulnerability assessment at least every six months and penetration testing at least every twelve, for critical systems and/or those in the DMZ carrying a customer interface. Paragraph 86 requires testing in an environment closely resembling production. Under the DPDP Act, a breach originating in a mobile app is reportable. CERT-In empanelment is the qualifying standard — we have held it since 2008.

Fully supported. Hybrid apps have their own quirks — JS bridges, exposed bundles, weak code obfuscation, frame-injection risks. We test the hybrid layer and the underlying native bridge with auditors specialised in each framework.

Yes — reports include platform-specific code examples (Swift, Kotlin, Java, Dart, JavaScript) with the exact lines to change. We also offer remediation walkthroughs with your mobile dev team and re-test rounds at no extra cost.