I will pentest and secure your mobile application

Both. I test native iOS (Swift/Objective-C), native Android (Kotlin/Java), and cross-platform apps (React Native, Flutter, Xamarin, Ionic). If you have both platforms, I recommend testing them together since they often share the same backend but expose different client-side weaknesses.

What do you need from me to get started? Four things: - The build (IPA, APK, or AAB) or a store link - Test accounts across different privilege tier - A clear scope including in-scope features and any backends.

No. I perform black-box and grey-box testing by default, decompiling and reverse engineering the build. If you provide source code, I can do a hybrid review and catch additional issues, but it's not required.

Yes. The APIs your app talks to are in scope by default, that's where the most impactful findings usually live (BOLA/IDOR, broken auth, business logic flaws). If your backend is owned by a third party, I'll need their written authorization too.

You get an executive summary for leadership, a technical report with CVSSv4 scoring, proof-of-concept, screenshots, and step-by-step reproduction for every finding, plus prioritized remediation guidance your developers can act on. Mapped to OWASP MASVS.

No. Testing is performed against a dedicated test environment or a non-production build whenever possible. If production testing is required, we agree on safe windows and exclusions.

Always. I work under NDA, store artifacts on encrypted media, and securely destroy all build files, credentials, and findings 30 days after engagement closure (or per your retention policy).