Vulnerable App

Make common mobile-application weaknesses visible so they can be studied in code and in a controlled environment. The purpose is educational: weaknesses are part of the exercise.

The project starts from the Expo template and adds login, a dashboard and application services. Project-specific documentation is in README_VULNERABILITIES.md; the main README remains the generic template guide.

Expo Router organizes screens. AuthContext coordinates login and user state; authService calls a mock Node.js HTTP backend. In the native environment, token and role are persisted in AsyncStorage.

The application uses the client-stored role in interface flows. The web version bypasses parts of native storage, so behavior is not identical across platforms.

HTTP, storage without additional protection and trust in client state make the problems observable in the lab. A mock backend makes reproduction easier without depending on a real service. These are educational choices, not proposed production practices.

test-vulnerabilities.sh checks mock availability, the HTTP scheme and the login response. Other weaknesses are described as exercises; the script does not automatically establish overall application security or coverage. No exploitation tests or application execution were performed in this review.

This application is intentionally insecure: use only fictional data in an isolated lab. Development addresses and the mock port must match the emulator; the login service contains machine-specific configuration.

The review does not repeat claims that any other application has unrestricted storage access: that depends on the environment and permissions. The verifiable point is using AsyncStorage for token and role without additional secure storage.

Read the lab documentation and compare authService, AuthContext and mock-server.js. After cloning the indicated revision, install dependencies and configure the local address before starting the mock and Expo in separate terminals. No public demo has been verified.