As the owner of an app, you may not write a line of code, but you are still accountable when customer data leaks or an account gets taken over. The good news is that most security comes down to sensible habits and asking the right questions. Use this checklist in your next conversation with your development team.
Accounts and logins
Weak authentication is one of the easiest ways in for attackers. Check that:
- Passwords are never stored in plain text on the server
- Repeated failed logins are slowed down or temporarily blocked
- Two-factor authentication or passkeys are available, at least for admin users
- Sessions expire and tokens can be revoked when a user logs out or a device is lost
- Password reset links are single-use and expire quickly
If your app offers social sign-in, make sure the integration follows each provider's current guidance.
Data on the phone
Assume phones get lost, stolen or shared. Ask your developers:
- What personal data is stored on the device, and is it truly needed?
- Is sensitive data kept in the secure storage provided by iOS and Android?
- Are API keys or secrets hard-coded into the app? They should not be.
- Does logging out remove locally cached personal data?
- Are screenshots or app switcher previews blurred on screens showing sensitive details, if appropriate?
The API and server
The app on the phone is only half the system. Most serious breaches happen at the API, because that is where the data lives.
Questions worth asking
- Does the server check permissions on every request, not just in the app's interface?
- Can one user access another user's records by changing an ID in a request?
- Are all connections encrypted with HTTPS, with no fallbacks to plain HTTP?
- Is there rate limiting to stop automated abuse?
- Are server logs monitored for unusual activity?
That second question catches a surprisingly common flaw. The app may hide other customers' data, but if the API returns it to anyone who asks, the protection is cosmetic.
Third-party code
Modern apps rely on many libraries and SDKs for payments, analytics, maps and more. Each one is code you did not write running inside your product. Keep an up-to-date list of them, remove anything unused and update dependencies regularly. Ask your team how they hear about security fixes in the libraries you depend on.
Updates and maintenance
Security is not finished at launch. New iOS and Android versions change permission rules and deprecate old methods, and new vulnerabilities are found in common libraries all the time. Budget for ongoing maintenance and agree a process for urgent fixes. Consider a minimum supported app version so you can require users on very old releases to update.
Access within your own team
Many incidents start internally, through a shared password or a former contractor who still has access. Review who can reach your developer accounts, cloud hosting, databases, analytics and admin panels. Remove people when they leave, use individual accounts rather than shared logins and switch on two-factor authentication everywhere.
Testing and reviews
For apps handling payments, health information or other sensitive data, an independent security review or penetration test before launch and after major changes is wise. Even for simpler apps, ask your team to include basic security checks in code reviews and automated tests.
Have a plan for when something goes wrong
Write down who to contact, how to disable compromised accounts, how to push an urgent update and what your obligations are to notify users or regulators. GDPR in the UK and EU, and various laws in the USA and Canada, set rules about breach notification. Deciding this in advance avoids panic later.
FAQ
Is a mobile app less secure than a website?
Not inherently. Both depend on secure servers and careful handling of data. Apps add the device itself as a place where data can be exposed, which is why local storage deserves attention.
How often should security be reviewed?
At minimum with every major release, and whenever you add payments, new types of personal data or new integrations.
What does ongoing security maintenance involve?
Updating libraries, applying platform changes, monitoring logs, reviewing access and fixing issues found by users or testers. The effort depends on the app's size and the sensitivity of its data.
Next step
Security works best when it is built in rather than added afterwards. Learn about our mobile app development and cloud hosting services, or contact Export Apps for a security-minded review of your current app.