# Mobile Security

> Mobile app security practices

- Skill: `ffsshhttiikk/mobile-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/mobile-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/mobile-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/mobile-security

---


## What I do

- Secure mobile applications against common vulnerabilities
- Implement secure data storage and encryption
- Protect against reverse engineering and tampering
- Secure network communications
- Implement authentication and authorization
- Handle sensitive data properly
- Conduct security assessments for mobile apps

## When to use me

Use me when:
- Building mobile apps with sensitive user data
- Apps requiring secure payment handling
- Enterprise apps with corporate data
- Apps subject to security compliance (HIPAA, PCI-DSS)
- Implementing biometric authentication
- Preparing security audit documentation

## Key Concepts

### OWASP Mobile Top 10
Critical mobile security risks:
1. Improper Credential Usage
2. Inadequate Supply Chain Security
3. Insecure Authentication/Authorization
4. Insufficient Input/Output Validation
5. Insecure Communication
6. Inadequate Privacy Controls
7. Insufficient Binary Protections
8. Security Misconfiguration
9. Insecure Data Storage
10. Insufficient Cryptography

### Secure Data Storage

**Android (EncryptedSharedPreferences):**
```kotlin
val masterKey = MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build()

val securePrefs = EncryptedSharedPreferences.create(
    context,
    "secure_prefs",
    masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)

securePrefs.edit().putString("token", authToken).apply()
```

**iOS (Keychain):**
```swift
let query: [String: Any] = [
    kSecClass: kSecClassGenericPassword,
    kSecAttrService: "com.app.service",
    kSecAttrAccount: "authToken",
    kSecValueData: token.data(using: .utf8)!
]

SecItemAdd(query as CFDictionary, nil)
```

### Code Obfuscation
- **Android**: ProGuard, R8, DexGuard
- **iOS**: LLVM obfuscation, symbol stripping

### Network Security
- TLS 1.3 minimum
- Certificate pinning
- No sensitive data in URLs
- Secure WebViews configuration