Mobile app links
App links are a host claim: the association file says which app may open which https paths. A claim that is too broad, or a fallback to an unverified custom scheme, becomes token theft when that path carries an auth callback.
Skill: Mobile links and API hosts
Ask: Which hosts does the app trust for links, and does the API check the same object ownership as the UI?
Stop: You have the association file or the claimed hosts, and one API call compared across two accounts.
Checklists
- Mobile links and app association - A link is an API entry. Read the association files, then open a link for your own account and record which app and which request result.
Disclosures
- A leftover trip endpoint returned another rider's driver details - Insecure direct object reference
Playbooks
- App Links and Universal Links - HTTPS app links are a verified host claim. Android uses assetlinks.json. Apple uses apple-app-site-association. A custom scheme is usually unverified. The bug is an auth callback that accepts the weaker claim.
Questions
Are custom URL schemes the same as app links?
No. HTTPS app links can be verified with assetlinks.json or apple-app-site-association. A custom scheme is usually unverified. The bug is an auth callback that accepts the weaker claim.
What should I open first?
The association files on hosts the app claims, then the path prefixes, then whether a host in that list is dangling or broader than the product. Stay inside the mobile surface the program allows.
This page is the linked pack hunt_brief("mobile") returns on the MCP connector. Authorized testing only.