# Scope a mobile security test: the app, the device and the API are separate boundaries

Source: https://www.web3sec.news/blog/scope-mobile-app-security-test
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Name the release question, app artifacts and backend environment.
- [ ] Agree devices, OS versions, roles, distribution and allowed techniques.
- [ ] Map local data, platform entry points and server authorization separately.
- [ ] Use synthetic data and record instrumentation-dependent conclusions.
- [ ] Tie retesting to patched app and backend versions with positive and negative cases.

## References
- [OWASP: Mobile Application Security Verification Standard](https://mas.owasp.org/MASVS/)
- [OWASP MASTG: mobile application security testing methods](https://mas.owasp.org/MASTG/0x04b-Mobile-App-Security-Testing/)
- [Android: Keystore protection and key-use restrictions](https://developer.android.com/privacy-and-security/keystore)
- [Apple: Keychain data protection and access conditions](https://support.apple.com/en-ca/guide/security/secb0694df1a/web)