Server-side security audit of a mobile app