> The threat model is "some user will look at the network traffic and see all the personal data we're hoovering from their phone". If you're talking about some

> The threat model is "some user will look at the network traffic and see all the personal data we're hoovering from their phone". If you're talking about someone wanting to examine an app they have installed, there's nothing a developer can do about it. There are frameworks like Frida that allow you to disable pinning or disable certificate verification entirely in an app. I did this myself once while reverse-engineer the API that an app was using. Configured my phone's system proxy to point to Burp Suite, then used Frida to disable certificate verification in the app so it'd let Burp do its MitM magic, and I could see all the app's network traffic.