Android Application Security Testing: What Should Be Covered?

The client is not a trusted boundary#

An Android app runs in an environment controlled by its user. Security-sensitive authorization decisions must be enforced by the backend regardless of what the app UI permits.

Application package review#

Check embedded secrets, debuggable builds, unsafe permissions, exported components and configuration. Finding a hard-coded key is important only after understanding what access it grants.

Local state and inter-app exposure#

Evaluate sensitive storage, exported activities and providers, deep links and WebViews. Consider what another application or a user with device access could observe or trigger.

Traffic and backend behavior#

Study transport settings, session management and API authorization. Server-side checks matter even when the app uses certificate pinning or obfuscation.

Deliverable quality#

Findings should distinguish exploitable exposure from routine reverse-engineering observations and explain affected user data and remediation options.