Use platform-level secure storage: Android Keystore and iOS Keychain. These are hardware-backed or TEE-backed and significantly more trustworthy than application-level storage. For remote credentials, establish a trusted session and store received tokens in the platform keychain — never in SharedPreferences, NSUserDefaults, or plaintext SQLite.

Misspell a package name by one character, and the misspelled version may already exist with malicious code. Your pipeline doesn't error because the package is real — just not the one you intended. Test this: generate probable typosquatting variants of your dependencies and check which already exist as published packages.

An emerging vector: attackers publish knowledge repositories (Obsidian vaults, Notion pages) with genuine technical content but embedded prompt injections. When a developer's AI agent processes this content, the injection produces compromised code. Supply chain risk now extends beyond code dependencies to the AI tools your team uses.

A particularly common misconfiguration: servers accepting JWT tokens with the none algorithm — effectively accepting tokens with no signature verification. This should be on every backend configuration checklist.

Mobile biometric authentication can be bypassed via runtime hooks (Frida) if it relies on client-side logic. Always use platform APIs (BiometricPrompt, LocalAuthentication) — and treat biometrics as one factor, not the only factor for sensitive operations.

An e-commerce app calculates the total on the client and sends it to the backend. An attacker intercepts the request, changes the total from $299 to $0.01, and the backend processes the order because it trusted the client's calculation. The fix: recalculate server-side. Never trust a number the client sends if it affects money, permissions, or access.

iOS: search Info.plist for NSAppTransportSecurity — if NSAllowsArbitraryLoads is true, ATS is disabled. Android: check AndroidManifest.xml for usesCleartextTraffic and review network_security_config.xml for custom trust anchors. Both checks belong in your CI/CD pipeline as automated gates.

Most privacy violations aren't intentional — they come from SDKs the team didn't audit. An analytics SDK collects location data. A crash reporter logs user email addresses. A push notification library stores device tokens with personally identifiable metadata. Every SDK is a privacy decision. Apple now requires privacy manifests from SDK authors too, but enforcement is inconsistent — your team still needs to verify.

VM protection adds overhead. Use it only for code sections where reverse engineering would cause material business damage (financial algorithms, DRM, proprietary logic) — not for the entire application.

Android: debuggable=false, allowBackup=false, usesCleartextTraffic=false, minimal permissions, ProGuard/R8 enabled. iOS: ATS enabled (no exceptions), no NSAppTransportSecurity bypasses, no test entitlements in release builds. Both: strip logging statements, disable verbose error responses, remove test endpoints from production API routing.

The most common leaks: clipboard (sensitive data copied stays accessible to other apps), screenshots (iOS takes a screenshot when backgrounding — if sensitive data is visible, it's cached), keyboard cache (autocomplete suggestions store typed passwords), and backup files (iCloud/Google backups include app data unless explicitly excluded). Each needs a specific mitigation.