02 / Mobile
Mobile application testing
iOS and Android apps tested together with the API behind them, which is where most mobile problems actually live.
Who it's for
Teams launching or updating an iOS or Android app, or facing an app store, partner or enterprise security review.
A mobile app is really two targets: the app on the phone and the API it talks to. We test both. The worst problems usually sit in the API, where anyone can reach them without ever opening your app.
What gets tested
- How the app stores data, keys and tokens on the device
- Traffic between the app and your servers, including certificate pinning
- The backend API, tested directly rather than only through the app
- Authentication, sessions and deep links
- Secrets baked into the app and what third-party SDKs are doing
- Platform-specific issues on iOS and Android
What you get
- A report with a summary for the people who asked for the test and technical findings for your developers
- Evidence and a clear fix for each finding, across app and API
- A call to go through the results with your developers
- A free retest once you've fixed things, with an updated report
Typical sizes
| Example | Days |
|---|---|
| Single-platform app with around 10 screens and a simple API | 2–3 |
| iOS and Android app with accounts, payments and an API | 4–6 |
| Large app with many roles, offline data and integrations | 7–10 |
At $1,200 per day. Examples only; every job is quoted after a free scoping call.
Questions
Do you need our source code?
No. Testing works from the built app. Source access makes testing faster and deeper, so it's welcome if you're happy to share it.
Do you test both iOS and Android?
Yes. If both apps share one backend, the API is tested once and the platform-specific parts separately.
Can you test before we launch?
Yes, and it's the cheapest time to find problems. A TestFlight or internal build is enough.
Get a quote for this test
A few questions about what you've built, and you'll have a fixed quote after a short call.