Overview
An Australian technology company was preparing to launch a new product made up of a web application and an iOS app. Before going live, they wanted independent assurance that both would stand up to real-world attacks, and that no sensitive data or credentials would be exposed to users or attackers on day one. The client’s name is kept confidential.
- Client: Technology company, Australia (name confidential)
- Scope: Web application, iOS app and its source code, pre-release
- Services: Web application penetration testing, iOS app penetration testing, source code security review (SAST and manual), DAST, retesting
- Outcome: Critical issues and exposed secrets found and fixed before launch, with every fix verified across two rounds of retesting
The Challenge
Launch deadlines often push security to the end, which is exactly when it is hardest to fix problems without delaying release. The client had three concerns:
- Making sure the web application and its APIs could not be abused to access other users’ data or functions.
- Confirming the iOS app did not leak sensitive data on the device or expose secrets inside the app package.
- Getting clear, developer-friendly findings early enough to fix them before the launch date.
Our Approach
We combined several testing methods so that issues missed by one technique would be caught by another:
1. Web Application Penetration Testing
Manual and tool-assisted testing of the web application and its APIs, covering authentication, session handling, access control between users and roles, input validation and business logic, guided by the OWASP testing methodology.
2. iOS App Security Testing
We assessed the iOS app with a layered approach:
- SAST (static analysis): automated analysis of the source code to flag insecure patterns early.
- Manual source code review: expert review of authentication, data handling, cryptography and API usage, where automated tools lack context.
- DAST (dynamic testing): testing the running app and its traffic to the backend, including how it stored data on the device and validated network connections.
3. Secrets Review
Because source code was in scope, we specifically checked for credentials, keys and other secrets that should never ship inside an app or repository.
What We Found
Testing uncovered critical security issues and exposed secrets that would have been live from the first day of release. Left unfixed, issues of this kind can allow attackers to access data, abuse backend services or misuse third-party accounts tied to leaked keys. Each finding was reported with its severity, evidence, steps to reproduce and clear remediation guidance for the client’s developers.
Remediation and Two Rounds of Retesting
The client’s team worked through the findings quickly and collaborated closely with us throughout. We then retested to confirm each fix, and carried out a second round of verification before go-live to make sure nothing had been missed or reintroduced. Secrets were removed from the codebase and replaced with secure handling, and the critical issues were closed and verified.
The Outcome
- Critical vulnerabilities and exposed secrets were fixed before any customer used the product.
- Every fix was independently verified, twice, before the go-live decision.
- The client launched with confidence and a documented, verified security baseline for both web and iOS.
- Their developers gained practical guidance they can apply to future releases.
Key Takeaways for Product Teams
- Test before launch, not after: fixing issues pre-release is faster and far less risky.
- Mobile apps need more than a web test. SAST, DAST and manual code review each find different problems.
- Scan for secrets in code. Keys and credentials in an app package can be extracted by anyone who downloads it.
- Insist on retesting, so “fixed” really means fixed.
Read more about what a thorough mobile assessment covers in our mobile app penetration testing guide and why web application penetration testing matters before launch.
Planning a Launch?
If you are preparing to release a web or mobile product, book a free consultation with our team and we will help you scope the right pre-launch assessment.
