Mobile and web security articles
Technical articles for developers and mobile teams, with links to the official documentation.
- API keys and secrets in an APK: what can be extracted and what to do Where secrets end up in an Android build, which keys are really secret, how to move them out of the app and how to check a release APK before publishing it. · 5 min read
- OWASP MASVS in practice: controls, profiles and testing The 24 MASVS v2.1 controls, how MASVS, MASWE and MASTG fit together, how to pick a MAS profile and how to use the standard on a real mobile project. · 7 min read
- HTTP security headers: what to set, what to remove, how to check CSP, HSTS, nosniff, frame-ancestors, Referrer-Policy and cookie attributes, with the values OWASP recommends, two nginx traps and a curl check. · 5 min read