The Mobile App Security Library

Threat modeling identifies and addresses potential security threats in a system, application, or process to help you design secure systems.

App tampering refers to unauthorized modifications made to an application’s code or operational environment to alter its behavior, bypass security measures, or manipulate its functions. This can include changes to the application's binary, the injection of malicious code, or modifications to its runtime environment.

Penetration testing, also known as "pen testing," is a security assessment technique in which ethical hackers simulate cyberattacks on a system to identify vulnerabilities before they can be exploited by malicious actors. It is a critical component of a robust security strategy, helping organizations understand their security posture and mitigate risks.

Certificate pinning is a security technique that increases secure communication over the TLS (transport layer security) protocol, like HTTPS. It ties a chosen TLS certificate or public key exclusively to the API server, allowing the application to reliably confirm the server's identity each time it connects. During interactions, the server presents a digital certificate to prove its identity and secures the encryption of data sent through APIs between the client and server. By matching the server’s shown certificate against a predetermined or "pinned" certificate within the app, certificate pinning ensures an additional layer of security, preventing man-in-the-middle (MITM) attacks and ensuring server communication integrity.