The app is in the attacker's hands
Unlike a web server, a mobile app is installed on a device you do not control. An attacker has unlimited time to decompile it, read what is inside, and run it on a modified device.
Our services · Mobile apps
Mobile Application Penetration Testing for iOS and Android
We manually test your mobile app on iOS and Android, together with the backend API it relies on, to find the flaws that expose your customers' data before an attacker does. Carried out by Saudi researchers ranked in the top 10 on bugbounty.sa.
- Pay only when a Critical or High finding is confirmed
- Manual testing by Saudi researchers ranked top 10 on bugbounty.sa
- Free retest until the finding closes
01 · Why it matters
Why your mobile app needs penetration testing
A mobile app is not a web server: it lives on devices you do not control and carries your customers' data with it. Those differences open risks a web test alone never reaches.
Your data lives on thousands of devices
Session tokens and customer data can remain stored on the phone. A lost device, or a malicious app on the same phone, may reach them if they are not protected.
Regulatory requirements
We document the penetration test report in line with the NCA Essential Cybersecurity Controls (ECC) and the Saudi Central Bank's Cyber Security Framework (SAMA CSF), helping you evidence that you meet the penetration-testing requirements for your apps.
Customer trust
An app that leaks data or gets breached costs more in reputation than in repair. Testing before release is cheaper than handling an incident after it.
02 · Scope
01
02
03
04
05
06
07
08
What we test in your mobile app
We cover the app itself on both platforms, the backend API it connects to, and the way it handles the operating system and the data stored on the device.
Insecure local data storage
We examine what the app stores on the device: iOS Keychain and Android Keystore, shared preferences, logs and caches. We look for session tokens and customer data kept unencrypted or in places another app can read.
Network communication and encryption
We verify that every connection between the app and its servers runs over sound TLS, and we test certificate pinning and how far it can be bypassed to intercept and modify data in transit.
Authentication and session handling
We review login, session renewal and logout across both the app and its API, and we test JWT, OAuth and SSO flows for sessions that never expire or tokens that can be replayed.
The backend API behind the app
The app is just a front end; the data lives in the API. We test access control and IDOR flaws that let one user read or change another account's data by changing an identifier in the request.
Reverse engineering and hard-coded secrets
We decompile the IPA or APK to extract what was built into it: API keys, server endpoints and sensitive logic. A key exposed inside the app belongs to anyone who can download it.
Tampering and runtime manipulation
We test the app's behavior on jailbroken and rooted devices and how robust its detection is, and we attempt to alter the app at runtime to bypass controls enforced inside the app.
Platform interaction
We inspect deep links, Android intents, WebView components and the permissions the app requests, looking for inputs another app or a malicious link can abuse.
Payment and in-app business logic
We test in-app purchases and sensitive business logic such as orders, balances and discounts, looking for price tampering or ways to skip payment verification steps.
03 · Our method
How we run mobile app penetration tests
Every finding is discovered by a human researcher, then verified and reproduced before delivery. We do not stamp automated scanner output into a report. We follow recognized checklists for mobile apps and their APIs, and reports are documented to help you meet the penetration-testing requirements set by regulators.
OWASP MASVSOWASP MASTGOWASP API Security Top 10PTESNCA ECCSAMA CSF
04 · How it works
Mobile app penetration testing, from first contact to retest
- 01
Share your requirements
Share your requirements or book a 30-minute consultation with a lead penetration tester. You decide what to test: the app on iOS, Android or both, and the backend it connects to.
- 02
Scope and rules of engagement
You create a program on the platform defining in-scope and out-of-scope assets, the rules of engagement (testing windows, forbidden techniques such as DoS, rate limits and escalation channels), and a suggested budget.
- 03
Agreement and confidentiality
Reliant reviews the scope and agrees the budget, and the program runs under Reliant's standard Engagement Agreement or your own contract once Reliant accepts it. An NDA is signed before any testing begins.
- 04
Testing and immediate escalation
The assigned researchers begin testing and Reliant triages every submission. An approved Critical or High finding can be sent to you the moment it is confirmed, ahead of the report.
- 05
Report and discussion
The report is delivered with every approved finding. You discuss each finding with Reliant through comments, and may be asked for your view (Company review).
- 06
Free retest
After fixing, you request a free retest while the program is in its report or retest stage, and you get the result as soon as the check is done.
05 · What you receive
Clear, auditable output
- A stable reference for every finding in RLT-000123 format to track it to closure.
- A CVSS score for each finding that shows its severity.
- A description and business impact written in plain language.
- Step-by-step reproduction (proof of concept) with supporting evidence.
- Practical remediation guidance for every finding.
- A dashboard holding all findings, and an auditable PDF report on request from the report stage.
- Free retests until the finding truly closes.
06 · Pricing
Outcome-based pricing for mobile app penetration testing
Pricing is outcome-based. If Reliant confirms at least one Critical or High finding, you pay the program's agreed budget, one amount for the whole engagement with no per-finding charge and no hidden fees, and the invoice is issued automatically with the report. If no Critical or High is confirmed, the invoice is zero and the test and its report are delivered free.
- One amount for the agreed program, with no per-finding charge.
- Duplicate, invalid or out-of-scope reports are never billed.
- No minimum engagement; a single service on a small scope is priced the same way.
07 · FAQ
All frequently asked questions
Mobile app penetration testing FAQ
What do we send you to start a mobile app test?
We need the app build (IPA for iOS or APK for Android) or its store link, along with test accounts in different roles and details of the backend it connects to. The clearer the access, the deeper the test.
Do you test both iOS and Android?
Yes. The two apps often differ in local storage and platform integration, so we test each platform you request on its own. You can choose one platform or both, and the scope and price are set accordingly.
Can you test an app already published on the store?
Yes. We test the published version, or a dedicated test build if one is available. We agree the rules of engagement in advance so that real users and their data are not affected.
Does testing affect real app users?
We work within windows and limits agreed before we start, and we test like a real attacker without disrupting the service. Any action that could touch real data is coordinated in advance, and a test environment with test accounts is preferred.
How long does a mobile app test take?
It depends on scope, and most tests are completed within 5 to 10 working days. Greater depth, more platforms and more backend APIs increase the duration, which we agree with you before starting.
How is mobile app penetration testing priced?
Pricing is outcome-based; you pay only if we confirm at least one Critical or High finding, and then you pay the program's agreed budget with no per-finding charge. If no finding of that severity is confirmed, the test and its report are delivered free.
Does mobile app penetration testing cover the backend API?
Yes. Most real risk sits in the API behind the app, so we test access control, IDOR and authentication in the backend alongside the app itself. A standalone API test can also be requested if you prefer.
Ready to test your mobile app?
Share your requirements or book a 30-minute consultation with a lead penetration tester, and pay only when a Critical or High finding is confirmed.
- info@reliant.sa
- +966 54 966 9661
- Riyadh, Saudi Arabia