Mobile App — Attack Surface Map
Unlike a website, a mobile app ships straight to the attacker’s device, where it can be taken apart. It stores data locally, asks for phone permissions, and talks to a backend over whatever Wi-Fi is around. Tap any numbered point to see how it can be broken and how it is defended.