Mobile binaries are distributed to every user and can be unpacked, so any API key, password, or service credential embedded in them should be treated as public. Credentials cached in shared preferences, plist files, or logs are just as exposed on rooted or backed-up devices. Attackers reuse these credentials to call backend APIs directly, bypass app-level checks, or take over accounts.
Never ship secrets in the app binary or config. Fetch short-lived, scoped tokens from a backend after authentication, store them only in iOS Keychain or Android Keystore, transmit them over TLS, and scan builds for hardcoded secrets in CI.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#01mobile01-2024 Improper Credential Usage
