A few weeks ago I sat down with a full penetration test report on a tenant app I'd been building. Twenty five findings. One critical. One high. Ten medium. Twelve low. One informational.
On paper, that looks like a checklist you work through top to bottom. In practice, fixing it taught me more about how a real app actually breaks than any code review ever has. This is what it took to close it, from the mobile side.
The critical: account takeover from two "small" gaps
The forgot-password flow leaked a user's internal ID in its response. On its own, not obviously dangerous — just an identifier. The change-password flow, separately, never asked for the current password before accepting a new one.
Neither issue is dangerous in isolation. Put them together and anyone could grab another user's ID from one screen and walk straight into their account from another. No credentials needed at any point.
