> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/checklist.md).

# Checklist

#### Static Analysis

* Insecure Data Storage
* Insecure Logging
* Root Detection
* Tap jacking
* Weak Cryptography
* Insecure Logging
* Hardcoded Credentials: credentials (such as usernames, passwords, API keys, etc.) directly into the source code.

#### Dynamic Analysis

* Certificate Pinning Bypass
* Insecure WebView Configuration

#### Others

* Lack of Root Detection \[Open the application and observe that the application doesn't prompt any warnings on a rooted device.]
* Lack of SSL Pinning 
* SSL Pinning Bypass
* Insufficient Runtime Debugging Protection
* Task Hijacking \[Check (LaunchMode=SingleTask) in `AndroidManifest.xml` file.
* Janus Vulnerability \[`apksigner verify -verbose target.apk`] application is signed with the v1 signature