# 5 Mobile App Security Vulnerabilities

> Found by a routine scan — nobody wrote any on purpose.

- **Format:** short video, 8 steps, ~25 seconds
- **Topic:** The five vulnerabilities a security scan finds in a working mobile app — a secret in the package, a token in plain storage, an endpoint with no auth, TLS validation left off from testing, and permissions it never uses — and why all five are defaults rather than mistakes.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-20
- **Tags:** mobilesecurity, appsec, android, ios, dotnetmaui, flutter, security, owasp, azure, apisecurity, devsecops, mobiledeveloper, cybersecurity, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/mobile-app-five-vulnerabilities/

---
## What you'll learn

- The five findings a scan reports on almost every working mobile app
- Why insecure storage and a disabled TLS check are leftovers, not bugs
- Which of the five to fix first, and why it is not the one you expect

## Understand it one step at a time

### 1. It works. Ship it?

Run one scan before you ship. This is a normal, working app — and that’s exactly the problem with all five findings below.

### 2. 1. A secret in the package

An API key sitting in strings.xml. Unzip the package and it’s just there — no exploit needed, just an archive tool.

### 3. 2. The token in plain text

Saved in SharedPreferences or UserDefaults instead of Keystore or Keychain — one word apart, and completely different in what it protects.

### 4. 3. An endpoint with no auth

The /admin route you added to test something never got an auth check — and it’s reachable from anywhere on earth right now.

### 5. 4. TLS checking turned off

Someone disabled certificate validation to test against a local server, and it shipped that way with nothing re-enabling it.

### 6. 5. Permissions it never uses

Contacts, location, camera — copied in from a sample project, granted, and never actually used or removed.

### 7. Fix number 3 first

It’s the only one of the five that needs no phone and no network access at all — anyone with curl can find and use it today.

### 8. All five are defaults

Nobody sat down and chose any of these five. They’re defaults nobody revisited — which is exactly why they’re still there.

---

## The takeaway

**All five are defaults, not mistakes.**

Which is why they survive code review — nobody wrote them, so nobody spots them.