iOS Security Audits & Mobile App Penetration Testing
OWASP MASVS reviews, Secure Enclave and Keychain hardening, jailbreak and instrumentation defence, regulated-environment compliance. The output is a prioritised remediation list with reproduction steps and the specific code change for each finding.
- OWASP MASVS L1 / L2 / R reviews aligned to your app's sensitivity
- Secure Enclave, Keychain, and File Protection configuration audits
- jailbreak detection and anti-Frida hardening for apps with real adversaries
Related work
How I accidentally became PureGym's unofficial Apple Wallet developer
Tired of fumbling with the PureGym app for 47 seconds every morning, I reverse-engineered their API to build an Apple Wallet pass that gets me in with a quick wrist scan. Along the way, I discovered their bizarre security theatre: QR codes that expire every minute while my ancient 8-digit PIN lives forever.
Read the article →
Epsy
Health companion app for epilepsy patients.
See the project →
Silk
The health metric your phone doesn't track
See the project →
Debunked the "iOS is secure by default" myth in 90 minutes. Walked through real pentesting techniques, tools, and war stories from the security trenches.
The second part of a thorough introduction into iOS Security, from various pentesting techniques, to possible flaws to use-cases and tools.
In this talk we will briefly cover all layers of iOS security architecture, delve into secrets of Secure Enclave and discuss the most common mistakes and vulnerabilities to prevent them from happening in the future, as well as have a sneak peek into penetration testing done right.
An overview of various techniques of penetration testing as well as some theory on iOS security. Just because securing is harder than developing.
Safari Extensions in all their beautifulness: from js-injections and html-changes on users' phones to content blockers.
What clients say
"Vadim was instrumental to the success Epsy enjoyed on iOS, taking it from an idea on a Miro board to the highest rated and most downloaded app of its kind on the store."
James C. · Mobile Engineering Lead, Epsy
"We had a strict deadline, and Vadim managed to complete the job in time. He gave us meaningful feedback and suggested better approaches, not trying to blindly stick to our specification."
Founder · Pre-seed streaming service
"I can say with confidence that it will be difficult to find a better developer. Vadim is achievement-oriented, highly organized, with very good communication skills."
Alex Z. · Co-Founder, eda.so
Common engagements
Full iOS security audit
A MASVS-aligned report. Every finding includes reproduction steps on a real device, severity scored against your threat model, and the exact code change to ship.
Pre-submission review
Half-day to two days. I find what App Review, enterprise IT, or an external assessor will flag, before it costs you a cycle.
Remediation sprint
I pair with you (or your engineers if you have them) and ship the fixes from the audit. Works when a client audit flagged issues and the timeline is tight.
Areas I cover
Pricing
Architecture reviews, hiring help, second opinions on that thing that's been bugging you.
Available nowFeatures, MVPs, migrations, firefighting. Minimum 5 days.
Available nowPriority support: review agency code, join architecture calls, catch problems before they ship.
Questions
Do you sign NDAs before the audit?
Yes, always. Signed before I see any code. Mutual NDAs if you'd like reciprocity.
Can you test the backend too?
iOS is my specialty, client-side specifically. If the backend work is entangled with iOS security posture (token minting, cert pinning rotation, webview origin handling), I'll cover that boundary. For deep server-side pentesting, I pair with partners or hand off.
How long does a typical audit take?
Small consumer app: 3–5 days. Medium app with SDKs in a regulated domain: 8–12 days. Large enterprise app with significant attack surface: 3–4 weeks. Send a detailed brief and I'll quote from it. If you'd rather talk first, a free 30-minute scoping call usually gets us to a number faster.
How do I get a quote?
Two paths. If you need speed, send me a detailed brief and I'll quote from it (usually within 48 hours). If you'd rather talk first, book a free 30-minute scoping call and I'll quote after. Most clients who pick the brief path land on the call anyway once we get into the specifics, but the door is open either way.
How quickly can you start?
Advisory calls can happen within days. For project work, I typically need 1-2 weeks notice to clear the calendar, though I keep some buffer for urgent firefighting. Check the availability badges above for current openings.
Do you work with early-stage startups?
Yes, from pre-seed to Series C and beyond. For very early teams, the advisory tier often makes more sense than project work: you get architecture guidance without committing to a large engagement before you've validated the product.
What's included in the day rate?
Everything: code, architecture decisions, code review, documentation, async Slack availability during working hours. No surprise add-ons. I bill for time spent working on your project, not for "thinking about it in the shower."
How do you handle timezone differences?
Currently in Vancouver (PST) with full overlap for North American teams. For UK and Europe, I'm online by their afternoon. For Gulf or APAC, we'd agree on overlap hours and handle the rest async. I've worked with teams from San Francisco to Dubai.
Where I've worked CV · LinkedIn
Need an iOS security audit?
Describe what you're working on, or book a free 30-min scoping call. I reply within 48 hours.
work@drobinin.com Book a free call →