Skip to content

Scan iOS Mobile Application using TestFlight

Scan a public TestFlight app

To create a mobile scan using a TestFlight public link:

  • Click "New Scan" in the top bar.

    New Scan Menu

  • Select "iOS TestFlight".

    Select iOS TestFlight

  • Fill in the TestFlight public URL, or a redeem code, and click "Continue".

    Fill in the TestFlight URL

  • Select the desired scan profile, for example "Fast Scan" for a quick static analysis or "Full Scan" for a comprehensive static, dynamic, and backend analysis. See Mobile Scan Profiles for all the profiles.

    Select Scan Profile

  • Depending on the profile, the next steps let you add test credentials, advanced settings, prompts, custom checks and tags. They are optional. If you do not need them, click "Start scan" to begin the scan.

    Start the Full Scan

  • Follow the scan from "Scans" in the top bar: it is queued, then running, then done.

    Scan Queued

Scan a private TestFlight app

Ostorlab scans private TestFlight builds, which are shared only with the testers you invite and have no public link. Invite support@ostorlab.dev as an external tester of the app and request the app once. Once it is enabled, everyone in your organisation can scan it.

Request the app

You can request an app from the scan form or from the "Private TestFlight Apps" page.

  • From the scan form: click "New Scan" in the top bar, select "iOS TestFlight", then the "Private" tab. Click "Request an app", or "Request another app" under the list if your organisation already has private apps.

    Private tab without apps

  • From the "Private TestFlight Apps" page, under "Attack Surface" in the menu: click "Request an app".

    Request an app from the Private TestFlight Apps page

  • Enter the app name exactly as it is listed in TestFlight, and click "Request".

    Request a private TestFlight app

  • In App Store Connect, open the app's "TestFlight" tab and add support@ostorlab.dev as a tester in an external testing group that has the build to scan.

The app is enabled within 24 hours of the invitation. If no invitation reaches support@ostorlab.dev, the app is not added to your organisation's private TestFlight apps.

Apple reviews a build before external testers can install it. Make sure the build has passed TestFlight App Review and is available to the external group.

Follow your requests

The "Private TestFlight Apps" page, under "Attack Surface" in the menu, lists the apps of your organisation:

  • "Enabled apps": the apps you can scan.
  • "Requested apps": the apps waiting for Ostorlab to accept their TestFlight invitation, marked "Pending". A pending request stays listed for 24 hours while Ostorlab processes its invitation.

A pending request

Once Ostorlab accepts the invitation, the app moves to "Enabled apps".

An enabled app and a pending request

Scan the app

  • Click "New Scan" in the top bar and select "iOS TestFlight".

  • Select the "Private" tab, pick the app in the "Private TestFlight app" list, and click "Continue".

    Select the private app

  • Select the scan profile, add the optional settings you need, and click "Start scan", as for a public TestFlight app.

The list only shows the enabled apps. A pending request is not listed until Ostorlab accepts its invitation.