What security practices do you follow when building a mobile app?
What the interviewer wants to hear
- Store secrets in Keychain or Keystore, never hard-code API secrets
- Use HTTPS only, consider pinning for high-risk apps
- Short-lived tokens with refresh, secure logout
- Validate everything on the server; the client can be modified
- Obfuscation, root/jailbreak checks and Play Integrity / App Attest where needed
- Minimal permissions and careful logging
Model answer
I assume the app binary can be decompiled and the device can be rooted, so I never put real secrets in the app. Tokens are stored in the iOS Keychain or Android Keystore-backed storage. All traffic uses HTTPS, and for high-risk apps like banking I add certificate or public key pinning with backup pins. I use short-lived access tokens with refresh tokens and clear everything on logout. Most importantly, the server checks every permission and input, because the client can be modified. For extra protection I enable R8 obfuscation, use Play Integrity or App Attest to check the app is genuine, and avoid logging personal data. I also request only the permissions the app really needs and follow OWASP MASVS as a checklist.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Mobile App Developer questions
- How would you add offline support to an app that currently only works online?
- Users say a list in your app stutters while scrolling. How would you find and fix the problem?
- Walk me through how you release a new version of a mobile app to the stores.
- What is dependency injection and how have you used it in a mobile app?
- How do you manage state in a Flutter or React Native app as it grows beyond a few screens?
- What testing strategy do you use for a mobile app, and what do you test at each level?
- How would you implement deep links in a mobile app from end to end?
- How do you make a mobile app accessible, and how do you check it?
- How would you set up CI/CD for a mobile app?