Field notes / Mobile security & backend APIs
Two focused resources that start with the trust boundary, show what a backend must verify, and link to runnable, synthetic demonstrations. They are teaching references, not evidence of third-party security assessments.
Mobile device integrity / iOS & Android
Both APIs help evaluate whether a mobile request comes from an expected app or environment. Neither proves that a signed-in user can access a particular resource. The backend still owns that decision.
Read the guideAPI security / authorization / reliability
A token can be valid while the operation is still unsafe. Test object access, editable fields, one-time evidence, and concurrent writes separately—and verify the server rejects each broken assumption.
Read the guideA plain Markdown checklist for authorized, reproducible mobile API reviews. Includes request-binding, authorization, replay, concurrency, and logging checks. No accounts or data collection required.
Download the security review checklist