This is a work in progress and not a release. We're looking for volunteers. See Issues to know how to collaborate.

Mobile Application Security

tag: [Engineer/Developer, Security Specialist]

Mobile applications are increasingly used as front-ends for web3 protocols. As more projects are using mobile applications, it also becomes an increasing target for threat actors. Below, you can find some suggestions to help protect your mobile application:

Best Practices

  1. Follow secure coding practices to prevent common vulnerabilities such as:

    • Insecure Data Storage
    • Insufficient Transport Layer Protection
    • Insecure Authentication
    • Insecure Authorization

  2. Use the trusted execution environment available in the device for secret management.

  3. Ensure that APIs used by the mobile application are secure and follow best practices for authentication and authorization by implementing certificate pinning to help prevent man-in-the-middle attacks.

  4. Encrypt sensitive data stored on the device and during transmission.

  5. Keep the mobile application and its dependencies updated to protect against known vulnerabilities.

  6. Leverage security libraries and frameworks designed for mobile application security, such as OWASP Mobile Security Project.