Mobile security vulnerabilities cluster in a predictable set of categories. The same mistakes appear in security audits of consumer apps, enterprise apps, and fintech apps with equal regularity. The recurrence of the same errors across different teams and different organizations suggests that the failures are not primarily due to ignorance — most mobile developers are aware that security matters — but to a gap between security knowledge and the specific engineering practices that translate that knowledge into secure code.