mobile-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/mobile-security/SKILL.md. --> # Mobile Application Security Android and iOS hardening: exported components, ATS, keychain, certificate pinning, root/jailbreak detection ## ALWAYS - **Android**: every `<activity>`, `<service>`, `<receiver>`, `<provider>` in `AndroidManifest.xml` either has `android:exported="false"` *or* explicitly declares an intent filter and is intentionally exported. As of Android 12 (API 31), `android:exported` is required when an intent-filter is declared. - **Android**: store secrets in the **Android Keystore** (`KeyStore` / EncryptedSharedPreferences with `MasterKey`). Never in plain `SharedPreferences`, plain files, or `BuildConfig`. - **iOS**: store secrets in the **Keychain** with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly` or stricter. Don't store in `UserDefaults`, plist, or files. - **iOS**: keep App Transport Security (ATS) enabled in `Info.plist`. If an exception is required, scope it to a specific host with `NSExceptionDomains`. - Validate the server's TLS certificate with **certificate pinning** (public key pinning preferred) for backends you control. Use `OkHttp.CertificatePinner` on Android, `URLSessionDelegate didReceiveChallenge` on iOS, or your framework's pinning module. - Obfuscate / shrink release builds (Android R8 / ProGuard with `proguard-rules.pro`; iOS