Scoping questions / Penetration testing

Mobile app penetration test scoping questions

The questions asked when scoping a mobile application penetration test, and why each one matters. Answer them online or in a fillable PDF.

Answer on this page Download the fillable PDF

10 questions · Fillable PDF · No email required to download

These are the questions a SilentGrid consultant asks when scoping a mobile application penetration test. Answering them first makes the call shorter and the quote more accurate.

"Not sure" is a fine answer. Working out the unknowns is part of what the scoping call is for.

Questions marked Sizing help us prepare an accurate quote.

Before any test

What prompted the test, and what date does the result need to meet?

Why we ask: the reason sets the depth and report format, and the date fixes the testing window and any retest.
Will testing run against production, staging or a dedicated test copy?

Why we ask: production needs tighter limits on load, data and timing. A test copy allows more thorough techniques.
When can testing run, and are there change freezes or peak periods to avoid?

Why we ask: the schedule is built around them.
Will you want fixes retested?

Why we ask: retesting is agreed at scoping, so it is scheduled and priced from the start.

Mobile applications

iOS, Android or both? Native, React Native, Flutter or a web wrapper? Sizing

Why we ask: each platform is tested separately, and each framework needs different instrumentation.
How will builds be shared, and can you provide one without obfuscation? TestFlight, APK, AAB or device management.

Why we ask: an unobfuscated build puts testing time into flaws rather than bypasses.
Does the app use certificate pinning, jailbreak or root detection, or anti-tampering?

Why we ask: testers need a build without them, or agreed time to bypass them, which also tests how well they hold.
What does the app keep on the device: tokens, cached records, offline data?

Why we ask: local storage review targets exactly that data.
Does it use biometrics, deep links, WebViews or push notifications?

Why we ask: each platform feature has known abuse patterns to test.
Is the backend API shared with a web application already in scope? Sizing

Why we ask: a shared API is tested once, which reduces effort.

Send your answers

Your answers go to the consultant who will run the scoping call. Leave out credentials, internal addresses and other sensitive detail: general descriptions are enough.

First name Last name Company Work email Phone Optional

Unanswered questions are fine; the call covers them. Handled under the privacy policy. The form is protected by Cloudflare Turnstile, which sets no cookies (Cloudflare privacy policy).