Ionic and Capacitor Penetration Testing

Every native capability your Ionic app uses, from the camera to encrypted storage, crosses Capacitor’s WebView bridge as a plugin call from JavaScript into native code. We test what each bridge call and plugin actually allows once it reaches the native side.

Why an Ionic and Capacitor app’s risk sits in the bridge and its configuration

Every native capability an Ionic app uses, from the camera to push notifications, crosses Capacitor’s WebView bridge as a plugin call passed from JavaScript into native Swift, Kotlin or Java code. Capacitor’s own security guide states plainly that every Capacitor developer is responsible for auditing their own app’s data, authentication, network and web view security, and it recommends configuring a Content Security Policy through a meta tag in the app’s own HTML rather than relying on one being set for you. We test what a plugin’s native implementation actually allows once a bridge call reaches it, and whether the release build ships with a CSP that restricts what the web view can load.

Data written with the official Preferences plugin lands in UserDefaults on iOS and SharedPreferences on Android, and Capacitor’s own documentation is explicit that this API is not meant to be used as a local database and carries none of the hardware-backed protection that iOS Keychain Services or the Android Keystore provide for a session token or an encryption key. Deep linking carries a separate risk: Capacitor’s security guide warns that a Custom URL Scheme is not globally controlled the way a web domain is, so a malicious app can register the same scheme and intercept a link, including the redirect an OAuth2 flow depends on, which is why it states PKCE must be used for any OAuth2 flow completed via a deep link. We test what your app actually stores in Preferences versus a Keychain or Keystore-backed alternative, and whether every deep link handler and OAuth redirect enforces PKCE the way the guidance requires.

Where a build receives updates outside app store review, that update path becomes part of the app’s attack surface. Ionic’s own commercial products announcement confirms new sales of Appflow, its own live-update platform, were discontinued in February 2025, with existing Appflow customers retaining access only through 31 December 2027, so we confirm during scoping which live-update mechanism, if any, your build currently uses before testing how it verifies an update’s authenticity. Every check made on the client side is still only a convenience once a request reaches your backend, so we test whether your API enforces authorisation independently of what the Capacitor client sends. Where your organisation also ships a React Native or Flutter build against the same backend, our React Native and Flutter penetration testing covers that app alongside this one.