# Mobile deep links: verify the destination without trusting the requested action

Source: https://www.web3sec.news/blog/mobile-deep-links-session-boundaries
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Inventory all link handlers, SDK routes and exported workflow entry points.
- [ ] Define the required account state and approved effect for each route.
- [ ] Verify domain association separately from parameter and server authorization.
- [ ] Test synthetic links across login, logout, account switch and installation states.
- [ ] Retest patched app, domain configuration and backend behavior together.

## References
- [Android: unsafe deep-link use and mitigations](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks)
- [Apple TN3155: debugging universal links](https://developer.apple.com/documentation/technotes/tn3155-debugging-universal-links)
- [OWASP: validate parameters in universal-link handlers](https://mas.owasp.org/MASTG-BEST-0072)
- [Android: exported app-component behavior](https://developer.android.com/privacy-and-security/risks/android-exported)