A field checklist for mobile app penetration testing built on OWASP MASVS, covering static and dynamic analysis, insecure storage, weak crypto, and cert pinning bypass, from testers who do this for a living.