A mobile security team should evaluate proxy and VPN risk detection by asking whether it separates ordinary network context from hostile interception, whether its certificate rules survive planned and unplanned certificate changes, and how the app behaves when validation fails. VPNs and proxies are used for privacy, travel and corporate access every day, so a good control informs decisions rather than blocking by default. This guide is for application security leads and mobile engineers. It covers the connection between your app and your own backend. Device-wide network security and web traffic sit outside it.
Proxy and VPN detection as a control is covered on mobile proxy detection. Interception attacks are covered on man-in-the-middle attack prevention.
Trust boundary: transport, intermediaries and identity
Three separate questions hide behind “is this connection safe?”. Ask each option to answer them separately.
Transport validation
- Does the app validate the server certificate chain against the platform trust store, and does it pin anything beyond that?
- On Android, does your network security configuration allow user-added certificate authorities for any build type?
- On iOS, if a user installs a configuration profile and turns on full trust for its root certificate, would your app accept a certificate issued by it?
Hostile intermediaries
- Can the option tell a proxy that only forwards traffic from one that terminates and reads it?
- Does it report an interception attempt with enough detail for your team to reproduce it in a lab?
App and backend identity
- Does your backend know the request came from the genuine app, independent of the network path?
- Do connection signals travel with the request, so the server decides with them in hand?
How Otukan answers. Otukan reads the system proxy configuration for your app’s traffic on Android and iOS. On Android it reads the VPN transport the system reports for the active network; on iOS it reports the VPN indicators available to an app. Interception indicators, such as a failed pinned connection and, on Android, unexpected trusted certificates, are flagged and correlated with hooking, debugging and app modification. Connection signals are attached to sensitive requests so your backend decides with network context, and the app can hold back a sensitive request when interception is indicated.
Lifecycle: certificates, network changes and approved proxies
Certificate changes
- Who owns your server certificates, and how much notice does the app team get before a rotation?
- If you pin, do you pin keys that stay stable across renewals, and do you ship a backup pin?
- What happens if a certificate must be replaced urgently, before users update the app?
Network transitions
- Test switching from Wi-Fi to mobile data mid-session, joining a captive portal and connecting and disconnecting a VPN.
- Does the option re-evaluate the connection after a change, or keep a stale verdict?
Approved enterprise proxies
- Which corporate proxies or VPNs inspect traffic by design, and must your app keep working through them?
- How are they marked as expected, and who keeps that list current?
How Otukan answers. Where pinning is used, Otukan plans certificate rotation, backup pins and outage recovery with you before release. Before enforcement, we test your legitimate network cases with your team: approved corporate proxies and VPNs, privacy tools and roaming. Your policy keeps enterprise users working while hostile interception is still reported.
Availability: failure handling before enforcement
A network rule that fails closed on the wrong day takes your app offline for everyone. Settle this section first.
| Scenario | Decide in advance |
|---|---|
| Certificate validation fails | Which flows stop, which continue, what the user sees |
| VPN or proxy present | Context only, step-up, or restrict for specific flows |
| Interception indicated | Restrict sensitive flows, report to backend |
| Signal endpoint unreachable | Queue, retry or proceed with local policy |
| Pin mismatch after rotation | Recovery path and how quickly it can ship |
- Which flows must stay available during a certificate incident, such as balance view or support contact?
- How long will you observe before restricting, and who approves the switch?
How Otukan answers. Responses are set flow by flow, from observe through warn and restrict to terminate. That lets a VPN stay context for browsing while interception restricts a payment. Coverage spans Android and iOS apps, native or built with Flutter or React Native, and protection joins your current build and release pipeline without your signing keys leaving your team.
Certificate strategy is covered on certificate pinning. Trust boundaries and certificate rotation for interception are covered on the man-in-the-middle prevention solution guide. Guides for other mobile security decisions are listed on mobile security solution guides.