so in the first project which I worked on is about a mobile banking application so since it's a banking related thing so we need to make sure all the in all the aspects of security since it deals with the transaction of amount with the customer information everything so for to make sure every security things are correctly implemented so we have few things like so hashing algorithms so we use hashing algorithm to hash all the passwords the user passwords so we use SHA-256 and SHA-512 hashing we have different things so we'll be using SHA-512 hashing to hash the password and send it to back-end so that even in between if someone is able to retry that password they can't able to find what password it is since we can't reverse back the hashing thing and all the API calls are encrypted and user data everything is encrypted and transmitted over the API request so that even if someone is interrupting because they can't able to retry back what data is since it's encrypted only the only using the only back-end keys will be able to decrypt the data using the key whichever the mobile app users so and we'll be we we used SSL pinning concept in our mobile application so we we have configured in the second network security XML file in Android application where we can pin the certificate and we can mention the certificate hash in our in that XML so that if if like if mobile app is trying to make any calls apart from that hash value then it will be restricted so only the domains with the which has the valid SHA value in that network XML security XML file the mobile app can able to make a API call so apart from that if someone is trying to change the domain while making the API call then the mobile app interrupts it and we have clear text traffic in Android manifest which will be which will be making this false so what it does is like it won't allow any HTTP connections so only the HTTPS connections it will be allowing in the while making an API call
