Comment by EMIRELADERO

Couldn't people do some reverse-engineering to figure out the first-party protocol and impersonate the official app in the API integration?