[Discussion] InfoSec Engineers: Let’s Share Our Best App Security Practices!

Hey fellow InfoSec folks! I’ve been diving deep into app security design lately and wanted to start a thread where we swap real-world, battle-tested security practices—the kind that actually block attacks, not just check a compliance box.

To kick things off, here are a few practices I’ve found game-changing for common app flows:

Anti-Replay + Request Tampering PreventionFor critical API calls (like payments or user data updates), we sign every request with a unique timestamp, a per-session nonce, and a secret key (stored securely on the backend, never client-side). The backend rejects requests that are too old (blocks replays) or have a mismatched signature (blocks tampering). No more headaches from "someone copying a valid request and replaying it 100x."

Full Request Payload EncryptionFor sensitive data in transit (beyond just TLS), we encrypt the entire request body with an asymmetric key (public key on the client, private key on the backend). TLS is non-negotiable, but this adds a second layer—especially useful when the app handles PII or financial data.

SMS Abuse Mitigation (Login/Registration Flows)We’ve all dealt with bots brute-forcing phone numbers to drain SMS credits or check if a number is registered. Our fix: rate-limit by IP + device fingerprint (not just phone number), add a lightweight CAPTCHA before sending the code, and block numbers that fail verification 3+ times in an hour. Cut abuse by 80% overnight.

These aren’t "perfect" solutions, but they’ve stopped actual attacks we’ve faced. Now it’s your turn!

What’s a security practice you swear by for app scenarios? Maybe something for session management, OAuth flows, or even client-side security? Let’s skip the theoretical stuff—share what’s actually worked for you.

Looking forward to learning from everyone!