Comment Comment by nicce 1. Not storing secrets properly or using hardcoded secrets2. Wild use of webviews/iframes sometimes easily propagates as XSS in phones3. Incorrect client-side OAuth 2.0 configuration e.g. with schema-based redirect URLs.4. Not supporting high-enough API versions, which may prevent some OS-related weaknesses5. The list is actually very long. Just few top of my mind. parent nicce 1 month ago
2. Wild use of webviews/iframes sometimes easily propagates as XSS in phones
3. Incorrect client-side OAuth 2.0 configuration e.g. with schema-based redirect URLs.
4. Not supporting high-enough API versions, which may prevent some OS-related weaknesses
5. The list is actually very long. Just few top of my mind.