Security Audit Artifacts: Pen-Test Reports, Vulnerability Assessments, and the Documentation That Wins Enterprise Deals

Components:
├── Flutter app (client)
│   ├── Authentication flow
│   ├── Local data storage
│   ├── API communication
│   ├── Push notification handling
│   └── Deep link / URL handling
├── Backend API
│   ├── Authentication endpoints
│   ├── Data endpoints
│   └── File upload/download
├── Third-party services
│   ├── Analytics
│   ├── Payment processor
│   └── Push notification service
└── Infrastructure
    ├── CDN / load balancer
    ├── Database
    └── Object storage

# Install MobSF (Docker is the easiest method)
docker pull opensecurity/mobile-security-framework-mobsf

# Run MobSF
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf

# Build your Flutter app in release mode
flutter build apk --release
# or for iOS
flutter build ipa --release

# Upload the APK/IPA to MobSF at http://localhost:8000
# MobSF will analyze and produce a report

<!-- android/app/src/main/AndroidManifest.xml -->
<!-- Fix: disable backup or use encrypted backup -->
<application
    android:allowBackup="false"
    ...>

<application
    android:allowBackup="true"
    android:fullBackupContent="@xml/backup_rules"
    ...>

<!-- android/app/src/main/res/xml/backup_rules.xml -->
<full-backup-content>
    <exclude domain="sharedpref" path="FlutterSecureStorage"/>
    <exclude domain="database" path="app.db"/>
    <exclude domain="file" path="sensitive/"/>
</full-backup-content>

# Verify the release APK is not debuggable
aapt dump badging build/app/outputs/flutter-apk/app-release.apk | grep -i debug

<!-- android/app/src/main/AndroidManifest.xml -->
<application
    android:usesCleartextTraffic="false"
    android:networkSecurityConfig="@xml/network_security_config"
    ...>

<!-- android/app/src/main/res/xml/network_security_config.xml -->
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>
</network-security-config>

// BAD — this string ends up in the binary, MobSF will flag it
const apiKey = 'sk_live_abc123xyz789';

// BETTER — fetch from secure backend at runtime
// The key never exists in the mobile binary
Future<String> getApiKey() async {
  final response = await httpClient.get('/api/config/keys');
  return response['api_key'];
}

# Install Frida
pip install frida-tools

# For Android: push frida-server to device
adb push frida-server-16.x.x-android-arm64 /data/local/tmp/frida-server
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"

# List running apps
frida-ps -U

# Attach to your Flutter app
frida -U -n "com.yourapp.name" -l test_script.js

// frida_ssl_bypass.js
// Tests whether certificate pinning can be trivially bypassed

Java.perform(function() {
    // Attempt to bypass common SSL pinning implementations
    var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    // ... (standard SSL bypass technique)

    console.log('[*] Attempting SSL pinning bypass...');
    // If this succeeds, your pinning implementation needs hardening
});

// frida_memory_dump.js
// Searches for sensitive data in the app's memory

Process.enumerateRanges('r--', {
    onMatch: function(range) {
        try {
            var content = Memory.readUtf8String(range.base, Math.min(range.size, 1024));
            // Search for patterns like API keys, tokens, passwords
            if (content && content.match(/eyJ[A-Za-z0-9_-]+\./)) {
                console.log('[!] JWT token found in memory at: ' + range.base);
            }
        } catch(e) {}
    },
    onComplete: function() {
        console.log('[*] Memory scan complete');
    }
});

// frida_root_bypass.js
Java.perform(function() {
    // Hook common root detection methods
    var RootBeer = Java.use('com.scottyab.rootbeer.RootBeer');
    RootBeer.isRooted.implementation = function() {
        console.log('[*] Root check bypassed — returned false');
        return false;
    };
});

1. Executive Summary
   - Scope of testing
   - Testing dates
   - Summary of findings by severity
   - Overall risk assessment

2. Methodology
   - OWASP MASTG reference
   - Tools used (MobSF, Frida, Burp Suite, custom scripts)
   - Testing environment (device models, OS versions)
   - Limitations and exclusions

3. Findings
   For each finding:
   - Title
   - Severity (Critical / High / Medium / Low / Informational)
   - OWASP MASVS mapping (e.g., MASVS-STORAGE-1)
   - Description of the vulnerability
   - Steps to reproduce
   - Evidence (screenshots, logs, code snippets)
   - Impact analysis
   - Remediation recommendation
   - Remediation status (Open / Fixed / Accepted Risk)

4. Positive Findings
   - Security controls that were tested and found effective
   - This is important — auditors want to see what's working

5. Appendices
   - Full tool output
   - Test case checklist
   - Tool versions and configurations

Finding: F-003
Title: Sensitive data stored in application logs
Severity: Medium
MASVS: MASVS-STORAGE-2

Description:
During dynamic analysis, application debug logs were found to contain
user authentication tokens and API request bodies including personally
identifiable information. Logs are accessible via `adb logcat` on
devices with USB debugging enabled.

Steps to reproduce:
1. Connect device via USB with debugging enabled
2. Run: adb logcat | grep "com.yourapp"
3. Perform a login in the app
4. Observe authentication token printed in logcat output

Evidence:
[Screenshot of logcat output showing token]

Impact:
An attacker with physical access to a device with USB debugging
enabled could extract authentication tokens and impersonate the user.
Risk is reduced by the requirement for USB debugging access.

Remediation:
Remove all logging of sensitive data in release builds. Use
Flutter's `kReleaseMode` flag to conditionally disable verbose logging.

Status: Fixed in build 2.3.1 (commit abc123)

Remediation Summary — YourApp v2.3.1

Finding F-001: Hardcoded API key in binary
  Severity: High
  Found: 2026-03-15
  Fixed: 2026-03-17
  Fix: Moved API key to server-side configuration endpoint.
       Mobile app fetches key at runtime via authenticated API call.
  Verified: Re-scan with MobSF confirms no API key patterns in binary.

Finding F-002: Backup flag enabled on Android
  Severity: Medium
  Found: 2026-03-15
  Fixed: 2026-03-16
  Fix: Set android:allowBackup="false" in AndroidManifest.xml.
  Verified: MobSF re-scan. Manual test: `adb backup` returns empty.

Finding F-003: Sensitive data in logs
  Severity: Medium
  Found: 2026-03-16
  Fixed: 2026-03-18
  Fix: Added log sanitization. Verbose logging disabled in release builds.
  Verified: `adb logcat` during authenticated session shows no tokens.

Finding F-004: Missing FLAG_SECURE on sensitive screens
  Severity: Low
  Found: 2026-03-16
  Fixed: 2026-03-17
  Fix: Added FLAG_SECURE to activities displaying PHI/PII.
  Verified: App switcher shows blank screen instead of content.

Total findings: 12
  Critical: 0
  High: 2 (2 fixed)
  Medium: 5 (5 fixed)
  Low: 3 (3 fixed)
  Informational: 2 (1 fixed, 1 accepted)

All High and Medium findings remediated. Re-assessment scheduled for 2026-04-01.

1. Architecture Overview
   - System diagram showing all components
   - Data flow diagram showing where sensitive data moves
   - Trust boundaries marked

2. Authentication Architecture
   - Auth flow diagram (registration, login, token refresh)
   - Token lifecycle and storage
   - Multi-factor authentication implementation
   - Session management

3. Data Protection
   - Encryption at rest: what's encrypted, with what algorithm, key management
   - Encryption in transit: TLS configuration, certificate pinning
   - Data classification: what's sensitive, what's not

4. Access Control
   - Role-based access control model
   - API authorization model
   - Client-side access control as defense-in-depth

5. Audit and Monitoring
   - What events are logged
   - Log format and storage
   - Anomaly detection capabilities
   - Incident response triggers

6. Third-Party Security
   - List of all third-party SDKs and their data access
   - Privacy policy review for each
   - Data processing agreements in place

7. Build and Deployment Security
   - CI/CD pipeline security
   - Code signing
   - Secret management
   - Dependency vulnerability scanning

# GitHub Actions example
security-scan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4

    - name: Build release APK
      run: flutter build apk --release

    - name: Run MobSF static analysis
      run: |
        docker run --rm -v $(pwd)/build:/input opensecurity/mobile-security-framework-mobsf \
          mobsf --scan /input/app/outputs/flutter-apk/app-release.apk \
          --output /input/mobsf-report.json

    - name: Check for high-severity findings
      run: |
        python scripts/check_mobsf_report.py build/mobsf-report.json \
          --fail-on high

    - name: Dependency vulnerability scan
      run: |
        dart pub outdated --json > dependency-report.json
        # Also run OSV-Scanner for known vulnerabilities
        osv-scanner --lockfile pubspec.lock

    - name: Upload security artifacts
      uses: actions/upload-artifact@v4
      with:
        name: security-reports
        path: |
          build/mobsf-report.json
          dependency-report.json