Mobile client security

Why this agent matters

A phone is a device you don't control. Data stored in plain files, cleartext traffic or exported components are open to anyone with the device or the network.

Mobile has its own platform rules (Keystore, Keychain, exported activities, WebView bridges) that general web reviewers miss.

What it checks

• Sensitive data in plain SharedPreferences or files
• Cleartext traffic and missing certificate pinning
• Over-exported activities and receivers
• Unsafe WebView settings (JS bridges, file access)

When it marks a finding as a likely false positive

• Data uses Keystore / Keychain
• Components are not exported unnecessarily

The fix it suggests

• Keystore / Keychain storage
• TLS with pinning
• Minimizing exported components and hardening WebView

Scope and limits

This agent validates findings reported by Semgrep, Gitleaks and Trivy; it doesn't hunt for new bugs on its own. A finding reaches it when its CWE or rule/path keywords match this vulnerability class. It sees only the minimal code around the finding, with secrets redacted, and returns a verdict with a confidence score, a plain-English explanation and a suggested patch.

Common questions

Related agents

• AI / LLM safety — Checks LLM application code for prompt injection and unsafe handling of model output.
• Network & transport security — Checks that data in transit is encrypted and certificates are actually verified.
• Privilege & file permissions — Checks file permissions, temp files, symlinks and unnecessary root.

See all 20 review agents → · Agent setup reviewer · How the pipeline works