> ## Documentation Index
> Fetch the complete documentation index at: https://how.to.usegolem.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Mobile Audits

> Static and dynamic analysis for iOS and Android apps

# Mobile Audits

Golem audits mobile apps — iOS and Android — using a dedicated pipeline that combines static binary analysis, store intelligence, and live probing of the app's backend.

| Property      | Value                                                     |
| ------------- | --------------------------------------------------------- |
| Platforms     | iOS (`.ipa` upload) and Android (store identifier)        |
| Pipeline      | Prescan → static analysis → live backend probing → report |
| Extra sandbox | `giga-mobile` image with mobile-specific tooling          |

## Adding a mobile app

1. Click **New App** and choose **Mobile**
2. Enter the iOS bundle ID or Android package name (e.g. `com.acme.app`)
3. Golem fetches the app's public store metadata (name, developer, icon, version) and uses the **public developer contact** to verify you're connected to the app
4. Sign the attestation confirming you are the developer or have written permission to test
5. For iOS, upload your `.ipa` on the app's **Assets** page — required before any iOS scan runs

## The mobile pipeline

### Prescan

A **prescan** is a lightweight first pass: the app is fetched, its binary is pulled down (from the uploaded `.ipa` for iOS, or the store for Android), and a static inventory is produced — embedded endpoints, hardcoded secrets, insecure storage hints, permissive settings. Run it before your first audit to see what's there.

### Audit

The full mobile audit adds:

* **Static analysis** — deep binary inspection for insecure configurations, hardcoded credentials, weak crypto, and exposed API endpoints
* **Live probing** — every endpoint discovered in the binary is checked from the outside: does it respond, does it require auth, does it leak data
* **Runtime checks** — on iOS with an uploaded binary, Frida-based dynamic analysis can be enabled for the platform
* **Report** — findings use the same structure as web audits, with severity mapped for mobile impact

## Findings on mobile

Mobile findings pass through a dedicated filter that suppresses scanner noise (fingerprintable-library detections, non-exploitable informational hits) so the report reflects real issues. Score deductions follow the same [security score](/audits/security-score) model as web audits.

## Verifying remediation

1. Ship a new binary version
2. Upload it on the app's **Assets** page
3. Re-run the audit — findings confirmed fixed are marked as revalidated against the previous audit

## Next steps

<Columns cols={2}>
  <Card title="Findings & Evidence" icon="circle-exclamation" href="/audits/findings">
    How mobile findings are structured and filtered.
  </Card>

  <Card title="Security Score" icon="chart-line" href="/audits/security-score">
    How the grade is calculated.
  </Card>
</Columns>