Storing user data: a security checklist

I turned the feedback I gathered on storing user data into a checklist:

• APKs can be decompiled; design for that possibility.
• Use SSL pinning, obfuscation, secure storage.
• On iOS use Keychain, plus device attestation and SSL pinning.
• Use IFDEF so debug files don’t end up in the release build.
• Never invent your own crypto.
• Lean on the server side as much as possible.

No single item is magic; security comes from these layers working together.