Build hybrid mobile applications like a security pro!

The talk opens with the mobile threat model. Hybrid apps are built from one codebase using frameworks such as React Native, Flutter, Cordova and Ionic, and much of their functionality comes from third-party open source libraries pulled from package managers. The speaker explains that device-side data and code are the main assets, that malicious apps and people with physical access are the usual threats, and that remote exploitation is generally considered less likely.

The core of the session walks through five application security principles and how each applies when choosing a library: least privilege for permissions, avoiding reliance on obscurity alone, minimizing the attack surface such as web views and deep links, client-side trust with jailbreak and certificate pinning considerations, and defense in depth. For each principle, the speaker points to specific API design issues, most notably boolean-returning checks that an attacker can flip on a device, and insecure defaults such as enabling JavaScript in web views or allowing certificate pinning to be disabled.

A short quiz showed three library documentation snippets with insecure options. The closing advice is to read past the example pages into full API docs, check for CVEs and maintenance status, confirm controls work on every supported platform, and lean on native OS security features. Resources included OWASP guides and the Apple platform security documentation.