s_streichsbier

Famous last words ;)

While leveraginvg serverless gives a lot of benefits in terms of hardening and infrastructure setup, all the traditional application security issues (e.g. OWASP TOP 10) like SQL injection can still apply.

I think for API consumption one important consideration is keeping API keys secure. Besides that, most of the modern issues I have seen are related to authentication and access control.

Regarding reverse engineering, I personally feel that this is not as important an issue as others. Anyone that get's access to an app or a mobile device will always be able to reverse engineer it. It is just a question of time and effort. Mobile apps mostly should have the same objective as modern browsers, as providing the UI and UX.

Business logic and security should be handled on the backend side.

If you are still keen on reverse engineering and resiliency against it, check out this document https://www.owasp.org/images/6/61/MASVS_v0.9.4.pdf.

These are excellent suggestions Bucephalus. One note though, they mainly deal with the infrastructure/network/os level security.

A simple SQL injection in the code would still be exploitable regardless of the countermeasures above.

So on top of what you have suggested, what are your ideas to get the security right on the code level of the applications?

<3

Good one, I didn't know that one yet. For the dynamic scans, I can also suggest https://www.securityheaders.com and https://ssllabs.com/