Reverse engineering, vulnerability assessment, and hardening for Android applications
Client-side subscription validation bypass. Hardcoded billing API keys in BuildConfig. Missing Play Integrity verification allowing unrestricted sideloading.
Unauthenticated gRPC endpoints exposing user data. Misconfigured Supabase RLS policies. JWT tokens with 10-year lifetimes hardcoded in client code.
Trial period trivially bypassed via app data clearing. Firebase Remote Config flag granting universal premium access. Zero anti-tamper or root detection.
A structured security audit report covering: application architecture analysis, SDK and third-party service enumeration, authentication and authorization review, subscription and payment flow security, hardcoded secrets inventory, proof-of-concept smali patches with runtime verification, and a prioritized remediation roadmap.
View Sample Report →You send the APK or XAPK bundle. We define scope, threat model, and timeline together.
Full reverse engineering — smali disassembly, Java decompilation, manifest analysis, SDK and service enumeration.
Proof-of-concept patches applied and verified on emulator. Real attack vectors demonstrated with runtime logs.
Detailed findings with severity ratings, prioritized fixes, and architecture-level recommendations delivered.