Carrying out an audit of a mobile application consists of finding the maximum possible number of vulnerabilities that may affect it. It is not only about carrying out security tests to check the connections with the server using dynamic analysis, it also includes a static analysis of the application to verify that no sensitive information is stored insecurely in the binary or on the device. It also ensures that it is not possible to circumvent security controls imposed by the developer.
To carry out the audit, it is necessary to use a standard such as OWASP MASVS and its MSTG testing guide, which establishes two security levels (MASVS-L1 and MASVS-L2) and a set of tests against reverse engineering (MASVS -R) to guarantee that a comprehensive audit of the application has been carried out.