Superapps application security comes down to two questions: can the one app everything runs through be trusted, and can each service behind it verify that for itself? Otukan protects the host app with obfuscation, integrity and runtime checks. It defends the single login that unlocks wallet, rides, orders and messaging, exposes incentive farming across services, and passes attestation and integrity evidence to every service backend. Each service team then sets its own response, so a strict wallet policy does not shut down chat. Mini-app code stays with its owners. Scope is documented for Android and for iOS separately, control by control.
Flows and trust boundaries in a superapp
A superapp concentrates risk in a way single-purpose apps do not. One account and one host binary sit in front of many services, each with its own backend and its own idea of what is sensitive.
| Flow | Trust boundary | Why it matters in a superapp | Otukan evidence |
|---|---|---|---|
| Sign-in and recovery | Shared identity service | One takeover exposes every service at once | Device binding, takeover signals, attestation |
| Registration and incentives | Growth and onboarding services | Bonuses across services reward farming | Onboarding evidence, automation signals |
| Wallet and payments | Payment backend | Stored value and saved cards sit next to low-risk features | Runtime integrity, attestation, device binding |
| Mini-app requests | Each partner or service backend | Partner code runs inside your host with your users’ session | Integrity status passed through the host |
| Service traffic | Your API endpoints | Many endpoints, many teams, one network path | Certificate pinning |
The shared identity is the highest-value target. Whoever holds it holds every service. Incentive farming comes next: when several services each run their own sign-up bonus, one farmed account can collect all of them. For the takeover chain, see mobile account takeover prevention.
Control fit: app, operating system and backend
The host app, protected by Otukan
Otukan protects the binary every service depends on. It obfuscates code, checks integrity while the app runs, and detects hooking, debugging, emulators, root and jailbreak in the host process. Because mini-apps run inside that process, a trusted host is the precondition for trusting anything they report. Otukan also keeps the environment for embedded partner components intact.
The operating system
Android and iOS supply the building blocks, and they differ. Play Integrity gives verdicts on the app, the device and the installing account. App Attest proves that a key belongs to a genuine instance of your app on an Apple device. Keys used for device binding live in the Android Keystore and the iOS Keychain. Otukan uses each platform on its own terms. How the server verifies that proof is covered on app attestation.
Service backends
This is where a superapp differs most. Otukan makes attestation and integrity results available to every service behind the host, and each backend verifies them independently. The payments team, the mobility team and a partner mini-app can each apply their own rules to the same evidence. For registration abuse, see KYC fraud prevention.
Evaluating superapp security
Supported platforms
Ask for scope per control on Android and on iOS, and for how the host framework is handled. Otukan documents each platform separately and protects hosts built natively or with Flutter and React Native. Mini-app runtimes and web views inside the host are scoped with you during onboarding.
Evidence each service can use
A signal is useful only when the right team reads it. Otukan agrees with the platform team and each service team which result reaches which backend, what a failure means for that service, and who responds.
User impact across services
Superapp users switch between services within a single session. Otukan starts every signal in observe mode and measures, service by service, how often it would fire on genuine users. Responses then apply only to the screens that need them, so a restriction on transfers does not lock someone out of a ride home. Policy changes take effect without a new store release, which matters when many teams share one release train.
The underlying Otukan product is described on mobile app security. A superapp already published in the stores can have a free App Exposure Check run on its public release.