Mobile Security Testing for a Specialty Retailer’s Shopping and Wallet App
A deep-link flaw that could move stored-value balances between members, fixed before the wallet launched.
Client name withheld by agreement- Client
- Specialty outdoor retailer, 5.2 million app members
- Region
- Seattle, Washington
- Year
- 2024
- Duration
- 6 weeks
- Scope
- iOS and Android · stored-value wallet · 64 APIs · 2 payment SDKs
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A specialty outdoor retailer was adding a stored-value wallet to its shopping app, so that 5.2 million members could hold gift card balances, member rewards and returns credit in one place and pay with a scan in store.
Stored value is spent like cash and is hard to recover once moved. The wallet was built by an outside agency on a tight timeline, and the retailer’s security team had no mobile testing capability of its own.
What we did
The approach, step by step.
- 01
Apps reverse-engineered
We decompiled the iOS and Android builds, reviewed local storage, certificate validation and logging, and found wallet tokens written to a shared app cache.
- 02
Deep links attacked
A crafted link could open the transfer screen with prefilled values on a reused session, moving a balance to another member with a single tap.
- 03
APIs tested against the standard
64 APIs were tested for authorization, rate limiting and replay against the OWASP MASVS and the API Security Top 10.
- 04
Fixes verified on both platforms
Transfers now require re-authentication, deep links are checked against an allowlist and tokens sit in hardware-backed storage. Every fix was retested before launch.
Outcomes
What changed, in numbers.
- 4
- high or critical wallet flaws closed
- 64
- APIs tested
- 5.2M
- members protected at launch
- 0
- open critical findings at release
We launched a wallet without lying awake about it. That was the whole point.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Edison, New Jersey · 6 weeks
Offensive Security & Resilience · 2025Online Ordering and Pickup Penetration Test for a Regional Grocery ChainA flaw that exposed any shopper’s order history and saved address, closed before the holiday ordering peak.
-
Albany, New York · 16 weeks
Offensive Security & Resilience · 2024Ransomware Resilience for a Gas and Electric Distribution UtilityIdentity, outage management and billing rebuilt from clean infrastructure in 19 hours during a full-scale exercise.
-
Stamford, Connecticut · 28 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls in ServiceNow IRM for a Payroll and Earned-Wage Platform537 requirements reduced to 126 controls in ServiceNow IRM, with 61% of control tests now running automatically.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.