Most systems assume:

“Requests coming from our app are safe.”

That assumption breaks quickly.

Mobile apps handle validation, flows, and restrictions — but the client environment is controllable. Requests can be modified, replayed, or triggered outside the UI.

The real issue isn’t missing validation — it’s misplaced trust.

What goes wrong

Client-side validation gets bypassed

Flows are executed out of sequence

Parameters are tampered

Requests are replayed

Example

❌ Vulnerable:

if (req.isKycVerified) { generateLink(); }

Enter fullscreen mode

Exit fullscreen mode

Client controls this flag.

✅ Correct:

User user = repo.find(req.userId);

if (user.getKycStatus() == VERIFIED) {

generateLink();

}

Enter fullscreen mode

Exit fullscreen mode

What to fix

Backend must be the source of truth

Validate all critical data server-side

Enforce flows on backend

Add idempotency for sensitive operations

Key takeaway

UI constraints are not security controls.

👉 Full breakdown on…