OWASP Mobile Top 10
This skill encodes the OWASP Mobile Top 10 for secure mobile app design and review. References are loaded per risk (progressive disclosure). Based on OWASP Mobile Top 10 2024.
When to Read Which Reference
| Risk | Read |
|---|---|
| M1 Improper Credential Usage | references/m1-improper-credential-usage.md |
| M2 Inadequate Supply Chain Security | references/m2-supply-chain-security.md |
| M3 Insecure Authentication/Authorization | references/m3-insecure-auth.md |
| M4 Insufficient Input/Output Validation | references/m4-input-output-validation.md |
| M5 Insecure Communication | references/m5-insecure-communication.md |
| M6 Inadequate Privacy Controls | references/m6-privacy-controls.md |
| M7 Insufficient Binary Protections | references/m7-binary-protections.md |
| M8 Security Misconfiguration | references/m8-security-misconfiguration.md |
| M9 Insecure Data Storage | references/m9-insecure-data-storage.md |
| M10 Insufficient Cryptography | references/m10-insufficient-cryptography.md |
Quick Patterns
- Store credentials and API keys in secure storage (keychain/Keystore); never hardcode. Validate all inputs and encode outputs.
- Use certificate pinning and TLS for communication; enforce privacy controls and minimal data collection.
- Harden binary (obfuscation, integrity); use secure defaults and encrypt sensitive data at rest.
Quick Reference / Examples
| Task | Approach |
|---|---|
| Store credentials | Use iOS Keychain or Android Keystore; never hardcode. See M1. |
| Secure network calls | Use TLS 1.2+, implement certificate pinning. See M5. |
| Validate input | Sanitize all user/external input before use. See M4. |
| Protect local data | Encrypt with platform APIs (EncryptedSharedPreferences, Data Protection). See M9. |
Safe - Android Keystore for credentials:
val keyStore = KeyStore.getInstance("AndroidKeyStore")
keyStore.load(null)
val secretKey = keyStore.getKey("my_key_alias", null) as SecretKey
Unsafe - hardcoded API key:
val API_KEY = "sk-12345abcdef" // NEVER do this - extract from APK
Certificate pinning (OkHttp):
val certificatePinner = CertificatePinner.Builder()
.add("api.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
.build()
Workflow
Load the reference for the risk you are addressing (e.g. credential handling → M1; network → M5; local storage → M9). See OWASP Mobile Top 10 for the official list.