Mobile app penetration testing in Coimbatore
Phones now run much of Coimbatore's manufacturing: production and inspection apps at the machines, order apps for dealers and salesmen, attendance apps for big workforces. Our engineers take apart the Android and iOS builds, look at what they store on the handset and probe the server behind them, working from Hyderabad.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, visits by arrangement
Last reviewed
01 / Local need
Why Coimbatore manufacturers test their mobile apps
Apps that touch production, orders and payroll make a phone a business system.
A textile unit records production counts on a tablet at each machine group. A pump maker's salesmen take orders and read stock on their phones while visiting dealers. A component supplier's HR team runs attendance and leave through an app used by hundreds of workers. These apps are often built by a local vendor for a particular plant, installed from a link rather than a store, and updated when someone remembers.
That makes the build itself part of the risk: an app distributed outside the store may carry a debug flag, test addresses or keys that a store review would have caught. We check the build as distributed, the data it keeps when the phone is offline and the server it syncs with. Our mobile application testing page describes the service, and VAPT services in Coimbatore gives the local view.
Shop-floor devices are often shared between shifts and rarely locked, which changes what a lost or borrowed device can do. We take that into account when we rate findings, because a flaw that needs a stolen personal phone is less urgent than one that works on a tablet bolted to a machine.
02 / Scope
Apps that fill our Coimbatore mobile testing
Six kinds of app account for most of the work here.
Shop-floor production and inspection apps
Tablets and phones at the machine group. We test the local store, the sync calls and what a shared or unlocked device exposes.
Dealer and salesman order apps
Apps that take orders and show stock and prices. Each login is checked for what it can see, including whether a salesman can reach customers who belong to another territory.
HR, attendance and leave apps
Apps for hundreds of workers. We test who can see salary and attendance data, how photos and locations are handled and what the API returns for another employee.
Owner and management dashboards
Phone views of production and sales for the owner. We test sign-in, token handling and what is cached on a device that leaves the building.
Apps installed outside the store
Builds shared by link. We test the build as distributed for debug flags, test servers, embedded keys and update handling.
The server side of each app
The worst problems tend to live on the server, which is why we replay the app's own requests against it, with and without a login and as different people.
03 / From our guide
From our guide: where apps leave data on the phone
Apps that work offline store data on the device, and sharing a device raises the stakes. The extract below lists where Android apps keep data and the corners that are easy to forget.
Android storage locations
- SharedPreferences — XML files in
/data/data/com.app/shared_prefs/. Plaintext by default; useEncryptedSharedPreferencesfor sensitive values. - SQLite databases — accessible to the app and to root. Use SQLCipher for sensitive data.
- Internal storage files — accessible only to the app's UID; safe for non-sensitive use, encrypt anything sensitive.
- External storage — historically world-readable; scoped storage on Android 11+ improves this but legacy apps still over-share.
- Keystore — backed by hardware on most modern devices; the right place for keys.
The forgotten places
WebView caches, logs (writing PII via Log.d or NSLog), screenshots taken automatically by iOS on app switch (cover sensitive screens with a privacy overlay), clipboard, autofill data, crash reporting payloads.
A mobile application penetration test audits all of them.
On a shop-floor tablet that several shifts share, anything left in these places is available to the next person who picks the device up. iOS storage and the rest of the guide are in the full storage article.
04 / What we find
Patterns we expect in Coimbatore shop-floor, dealer and HR apps
Apps built for one plant tend to share a few weaknesses.
Show details for Patterns we expect in Coimbatore shop-floor, dealer and HR apps
- Offline data kept unprotected. Production records, customer lists and employee details in a local database that a lost or shared device gives away.
- One shared login per shift or machine group. Credentials that several people use, so that actions cannot be traced.
- Keys and addresses compiled in. Server addresses, test credentials and API keys inside a build that anyone can unpack.
- Debug builds in production. An app shared by link that still has logging and a debug flag on.
- Salesmen who see every territory. A sync call that returns all customers' balances because the filter lives in the app.
- Photos and locations stored in the clear. Attendance selfies and GPS points kept in a folder other apps can read.
Because plant apps are rarely updated on a fixed schedule, server-side fixes carry extra weight: they protect every installed version at once, including the ones nobody will update.
05 / Rules and customers
What Coimbatore customers and auditors ask about apps
Export customers, auditors and the law each approach the app from a different side.
Show details for What Coimbatore customers and auditors ask about apps
Export customers ask how data on a supplier's apps is protected, especially where an app exposes orders or pricing. An ISO 27001 auditor will place any app that holds company data inside the scope. Attendance and HR apps process staff records that the Digital Personal Data Protection Act treats as personal data, with the working rules arriving in 2027; our DPDP page says where testing fits.
Apps published on Google Play face a new target rule: Google Play now asks for Android 16 (API level 36) from every new app and every update submitted after 31 August 2026; developers who asked for more time had until 1 November 2026. Apps installed outside the store are not bound by that rule, but they inherit the same platform changes, so test the build you actually distribute.
06 / How it runs
How a mobile test fits a Coimbatore plant
Because shop-floor devices are shared, we plan the test around the devices as much as around the app.
Show details for How a mobile test fits a Coimbatore plant
Before day 1
Which build, which devices
A call fixes the app version, how it reaches users and whether our own devices will be used, and sets a window that does not disturb a production shift.
Day 1
Build and role accounts
You send the build by link and a test login for each role: operator, salesman, HR user and owner. We install it on our devices and confirm that sync works.
Days 2 to 7
Handset first, then server
The build is taken apart first; then we watch what the app stores and sends, run it on a handset with no screen lock, and attack the API directly, phoning you about anything urgent.
OutputEvidence from the handset and from the server
07 / Questions to ask
Questions a manufacturer should ask a mobile tester
These help when apps are built locally and shared by link.
- Will you test the build as we distribute it, including apps shared outside the store?
- How will you treat devices that several shifts share?
- Will you check the local database and what offline sync leaves behind?
- Do you test the server directly, signed in and signed out?
- What will the report say about debug flags and embedded keys?
08 / Delivery
Delivery of mobile tests to Coimbatore plants
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
Mobile test pricing for Coimbatore manufacturers
An app together with its API is a standard-band job that begins from INR 27,000 + 18% GST, and extra apps, roles or a larger API raise it. A set of plant apps from one vendor can be scoped in one proposal. The mobile cost guide explains the factors.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Do you test apps that are installed outside the Play Store?
Yes. We test the build as distributed, including debug flags, test servers, embedded keys and the update mechanism, which a store review would otherwise have caught. See the section on Apps that fill our Coimbatore mobile testing above.
Can you test an app that works offline on a shop floor?
Yes: the local database, its protection, the sync traffic and what a shared or misplaced device gives away are all examined. See the section on Apps that fill our Coimbatore mobile testing above.
Will you test the HR and attendance app?
Yes. We check who can see salary and attendance data, how photos and locations are stored and what the API returns for another employee. See the section on Apps that fill our Coimbatore mobile testing above.
Is a Coimbatore visit needed for a mobile test?
Normally not. Builds arrive by link and the readout is a call; a visit is arranged only if a device on site must be examined. See the section on Delivery of mobile tests to Coimbatore plants above.
Does the Play Store target rule apply to our apps?
Only to apps published there. Apps shared by link are not bound by it, but they face the same platform changes, so we recommend testing the build you distribute. See the section on What Coimbatore customers and auditors ask about apps above.
What should we budget?
Budget from INR 27,000 + 18% GST, with the number of apps, roles and the size of the API deciding the rest. See the section on Mobile test pricing for Coimbatore manufacturers above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana