How can I check if an Android application running on a not rooted device is "secure" without knowing its source?
I would look for:
Plain text in Web-Requests (wireshark and emulator)
SQL-injection (in EditTexts...)
Doing stuff, that isn't always expected (i.e. fast clicking to check for race conditions)
Question: What else could be interesting for auditing Android apps?