​

Mobile Audits

Golem audits mobile apps — iOS and Android — using a dedicated pipeline that combines static binary analysis, store intelligence, and live probing of the app’s backend.

​

Adding a mobile app

1. Click New App and choose Mobile
2. Enter the iOS bundle ID or Android package name (e.g. com.acme.app)
3. Golem fetches the app’s public store metadata (name, developer, icon, version) and uses the public developer contact to verify you’re connected to the app
4. Sign the attestation confirming you are the developer or have written permission to test
5. For iOS, upload your .ipa on the app’s Assets page — required before any iOS scan runs

​

The mobile pipeline

​

Prescan

A prescan is a lightweight first pass: the app is fetched, its binary is pulled down (from the uploaded .ipa for iOS, or the store for Android), and a static inventory is produced — embedded endpoints, hardcoded secrets, insecure storage hints, permissive settings. Run it before your first audit to see what’s there.

​

Audit

The full mobile audit adds:

• Static analysis — deep binary inspection for insecure configurations, hardcoded credentials, weak crypto, and exposed API endpoints
• Live probing — every endpoint discovered in the binary is checked from the outside: does it respond, does it require auth, does it leak data
• Runtime checks — on iOS with an uploaded binary, Frida-based dynamic analysis can be enabled for the platform
• Report — findings use the same structure as web audits, with severity mapped for mobile impact

​

Findings on mobile

Mobile findings pass through a dedicated filter that suppresses scanner noise (fingerprintable-library detections, non-exploitable informational hits) so the report reflects real issues. Score deductions follow the same security score model as web audits.

​

Verifying remediation

1. Ship a new binary version
2. Upload it on the app’s Assets page
3. Re-run the audit — findings confirmed fixed are marked as revalidated against the previous audit

​

Next steps