Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET"
How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely positive that I could do that job and earn a lot more than a generic app developer.
From experience, most are very junior and use automated solutions which just don't make sense. When we do ours we really focus on core elements and very material findings... as everyone should. But competency is so rare in this field it's hard to follow.
Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET"
How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely positive that I could do that job and earn a lot more than a generic app developer.