Mobile + API Combined Assessment

It tests a mobile app and its backend API as one system. The app is tested with the OWASP MASVS and MASTG, the API with the OWASP API Security Top 10, and then the flows that cross the boundary between them — authentication, tokens, and server-side enforcement — with every finding proven and rated.

The most damaging issues live at the boundary. The app's interface hides actions and fields, so a test that only drives the app misses them — but the API still exposes them. Testing both together lets us send the app's own requests directly and check whether the server enforces the rules the app appears to.

Broken object level authorization is when the API returns or changes an object based on an ID in the request without checking that the caller owns it. Change the ID and you reach someone else's data. It is the top API risk, so we test it directly with a second account against the first.

We can work black-box from the outside, grey-box with test accounts and API documentation, or white-box with source access. Grey-box is the usual choice; white-box gives the deepest coverage. Either way we ask for at least two accounts per role so we can test one user against another.

We prefer a staging environment with representative data, because API testing sends many requests and probes authorization boundaries. Where a test must touch production, we agree the limits in advance and avoid any destructive or high-volume action.

We test the API the app actually uses, whether it is REST, GraphQL, or another style. The authorization and authentication risks in the API Security Top 10 apply across styles; the way we exercise them adapts to the interface.

Each finding gets a CVSS score for a common baseline, adjusted by the real impact in your system — what an attacker reaches, how easily, and what data or accounts are at risk. That is why two issues with the same CVSS can be prioritized differently.

Yes — after you remediate, we re-test the reported findings on both the app and the API to confirm each fix holds. Duration depends on the size of the app and the number of API endpoints, and we give a firm estimate after scoping.

We scope the endpoints and services in the assessment up front. Testing more services adds effort, so we agree the boundary before we begin and reflect it in the estimate — nothing is tested outside the agreed scope.