AppSec Solutions analyzed 89 popular Russian food and grocery delivery mobile applications using the Appsec.Sting platform. The audit, conducted via black-box testing, identified 3,590 vulnerabilities across 74 categories without accessing source code.
The findings include 1,290 critical, 370 high, and 499 medium-severity vulnerabilities. On average, each application contains about 40 security flaws, with 18 to 19 requiring immediate attention. The sector also leads in low-level vulnerabilities, with 211 identified.
The most frequent critical issue is the storage of sensitive information directly within the application code. High-level risks often stem from insecure AndroidManifest.xml configurations and network interaction errors. These flaws can expose API keys, leading to unauthorized cloud service usage.
Experts note that delivery apps possess a wide integration surface, including maps, payment gateways, and loyalty programs. Inadequate security impacts unit economics through fraud, such as bonus abuse and emulator farms. Since May 30, 2025, companies face turnover-based fines for repeated data leaks.
To mitigate risks, developers should move secrets to backend storage, implement token rotation, and improve deeplink validation. Security audits must be integrated into the weekly release cycle, and companies should monitor the integrity of all application versions distributed across various platforms.
