Certificate pinning absent
What it looks like
// api.ts: a plain fetch to the API.
const res = await fetch(API_URL + "/account", { headers: authHeaders });
// app.json: no network security config. No pinned certificates.
// Any CA the phone trusts is accepted. That includes one a user installs.What happens
Someone who can put a certificate on a phone, for example on a shared or managed device or a rooted one, can read and alter everything the app sends, including login tokens.
Where it shows up
Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.
Check it yourself
Uses your builder's dashboard and your browser. No tools to install.
- Search the project for pinning-related words: pin, sha256, certificate, network_security_config, NSPinnedDomains, trustkit.
- Check app.json or app.config.js for an Android network security configuration or an iOS pinned domains entry.
- Ask whoever built the app what happens on a phone with an intercepting proxy such as Charles or mitmproxy installed. If requests still work, the app is not pinning.
- A bad result is no pinning code or configuration at all in an app that handles logins, payments or health and finance data.
What we check
We run the app on an instrumented device with our own trusted root certificate installed and record which requests we can intercept and modify. The report shows the traffic captured, what it contained, and whether pinning would have blocked it.
Fix direction
Decide first whether pinning fits your app: OWASP MASVS lists it as a network control and the MASTG notes its trade-offs around certificate rotation. Where it fits, pin the public key rather than the leaf certificate, keep a backup pin, and plan how to update pins before they expire.
Mechanism documented in: OWASP MASVS-NETWORK-2: Certificate and identity pinning (verified 2026-09-21); OWASP MASTG: Mobile app network communication (verified 2026-09-21).
Related patterns
- Secrets in the mobile app bundleMobileCritical
Anyone who downloads the app from the store can unzip it and read the key, then run up your bill or read your database as an administrator.
- Tokens trusted without server verificationLogin and permissionsCritical
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
- Sessions that survive logout and password changesLogin and permissionsHigh
Someone who once had a user's token, on a shared computer or through a leak, keeps access after the user logs out or changes their password.
- Authorization enforced only in the browserLogin and permissionsCritical
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Questions
does my mobile app need certificate pinning
It depends on the data. HTTPS already protects against an attacker on the same network who has no access to the phone. Pinning (checking that the server's certificate or key matches one you shipped) adds protection when someone can install a trusted certificate on the device, which matters for finance, health and enterprise apps. OWASP MASVS lists it as a network control for higher-assurance apps, with maintenance costs to weigh.
how do i check if my react native app uses ssl pinning
Search the code and configuration for pinning terms and check for an Android network security config or iOS pinned domains. A practical test is to run the app through an intercepting proxy on a test device; if the requests still succeed with the proxy's certificate installed, nothing is pinned.
what happens if a pinned certificate expires
The app refuses to connect until users install an update, which is the main trade-off the OWASP testing guide describes. Pin the public key instead of the leaf certificate, ship a backup pin, and set a calendar reminder tied to your certificate renewal so the update goes out first.
Back to the catalogue, or run the self-check for your stack.