GET /m/v3/users/usr_A/cards403 ForbiddenGET /m/v3/users/usr_A/locations403 ForbiddenGET /m/v3/users/usr_A/orders200 OK
ZF-0231-01High
A mobile session can read another user's orders
Session
User B, iOS app
Request
GET /m/v3/users/usr_A/orders
Response
200 OK
Human-verifiedAI-found ZF‑0231‑01 2026‑09‑28
Same app. Separate users.
Illustration: two users of the same mobile app, separated by a user boundary. Requests made with User B's app session try to reach User A's data. Two are refused with 403. One, GET /m/v3/users/usr_A/orders, returns 200 OK with User A's orders; a researcher records it as finding ZF-0231-01, High, human-verified.
ReportCover and question1/11
Start with a change. Ask the right question.
Three illustrative scenarios. They explain the work; they are not customer findings, and platform coverage is confirmed during scoping.
01App and API
The screen hides it. Does the API?
Does the API behind the app enforce the same rules the interface implies?
Situation
You are shipping a release whose screens only show each user their own data.
Focus
Selected mobile API operations, sessions and object ownership, using designated test accounts.
Output
Findings tied to the screens, requests and roles they affect, not endpoint counts.
Illustrative request
# User B session, User A order
GET /m/v3/orders/ORD-88213 HTTP/1.1
Authorization: Bearer ██████████████
HTTP/1.1 200 OK
02On-device data
What stays on the phone. Who else can read it.
Is sensitive data stored, logged and protected the way your team intends?
Situation
Your app keeps tokens, cached records or keys on the device.
Focus
Agreed builds, local storage, keychain or keystore use and logs, on designated test phones.
Output
What was found, how it was reached on the agreed build, and the practical fix.
Illustrative request
# Agreed test build, app storage
shared_prefs/session.xml
refresh_token: ██████████████
stored without encryption
03Sign-in and deep links
A link opens the app. What else does it open?
Can the agreed flows be driven into a state the app did not intend?
Situation
You are adding deep links, social sign-in or a new authentication flow.
Focus
Selected deep links, sign-in and session flows, within the operations explicitly authorised.
Output
Reproduction steps engineering can follow on the same build.
Illustrative request
# Deep link opened from an external page
app://account/email?new=████████████
email changed without re-authentication
Agree on the builds. Then agree on the access.
Apps & builds
Candidate scopeNamed iOS and Android apps, versions and the builds to test.
Confirm before testingPlatform fit, how builds are delivered and whether store or test builds are used.
Accounts & roles
Candidate scopeDesignated test accounts for the user roles in scope.
Confirm before testingAccount ownership, test data and the contact responsible for access.
Backend APIs
Candidate scopeThe mobile API operations and services the app depends on.
Confirm before testingHosts and environments in scope; third-party services are excluded unless agreed.
Operational limits
Candidate scopeEnvironment, ownership, testing windows and an escalation contact.
Confirm before testingProduction constraints and stop conditions are agreed, never assumed.
Delivery & retest
Candidate scopeScope summary and human-verified findings.
Confirm before testingSensitive-data handling, report requirements, retest scope and terms.
A review of selected app flows does not represent the whole app or its backend. Untested or excluded areas are named; they are never treated as evidence that a system is secure.
Research can be autonomous. Delivery has an owner.
01
Investigate
Agents map the app's screens, API calls and stored data within scope.
AI-supported
ZF-0231-01
Severity
High
Class
CWE-639
CVSS 3.1
7.7
A mobile session can read another user's orders
Impact Any signed-in user could read 146 orders, with delivery addresses, belonging to another account.
Evidence
# Session: User B, iOS app
GET /m/v3/users/usr_A/orders
200 OK (expected: 403 Forbidden)
High
02
Verify and approve
A researcher reproduces the behaviour on the agreed build and judges impact.
Review desk
Human-verifiedAI-found ZF‑0231‑01 2026‑09‑28
03
Deliver
Findings, fixes and what the build or access did not allow us to assess.
Your team
Open questionAn issue that cannot be reproduced on the agreed build stays an open question, never a confirmed finding.
Mobile context. Ready for engineering.
LeadershipScope, material findings and business context.
EngineeringAffected screens, API operations and remediation.
Follow-upCoverage limits and retest results on a later build, where agreed.
01
Context and affected flows
App, build, platform, roles and the agreed environment.
02
Supporting evidence
Expected versus observed behaviour, with the request or the stored data.
03
Impact and uncertainty
Demonstrated impact, separated from hardening advice.
04
Remediation and retest
Suggested changes and their follow-up status.
Controlled research resources.
Agents use designated resources for approved scenarios. Testing runs on agreed builds and test accounts, never on your users' phones or data.
01
Designated test phones
Research phones and emulators run the agreed builds and are reset when the work ends.
02
Owned DNS records
Records on our own domains support agreed checks of callbacks, deep links and outbound paths.
03
Scoped test accounts
Accounts are provided for named roles, and access is removed when the work ends.
Straight answers
Do you test iOS and Android?
Both platforms can be in scope. The apps, versions and builds are confirmed during scoping.
Do you need a special build?
Not always. A store or test build can work. If a build that allows traffic inspection would help, we agree that before testing starts.
Do you test the backend too?
The mobile API operations the app depends on are usually part of the work. Which hosts and environments are in scope is agreed in writing.
Will you use real users' accounts or data?
No. Testing uses designated test accounts and agreed test data only.
Bring your scope. Let's plan the Countermind.
Thirty minutes with a Zaaf researcher. You bring one scope; we show you what a Countermind would look at first.