Everything below is included. Untick anything you want left out. Based on the OWASP Mobile Application Security Testing Guide.
Local data storage What the app leaves on the phone — databases, preferences, cache, logs, backups, Keychain and Keystore use
Login and account security Login bypass, weak passwords, OTP problems, biometric bypass, how tokens are stored and expired
Permissions and access control Whether a user can reach another user's data, or use functions meant for admins only
Network communication HTTPS use, certificate validation, certificate pinning, cleartext traffic, sensitive data in requests
Static analysis of the app package Reading the app to find hardcoded keys, passwords, URLs, debug information and insecure settings
Runtime behaviour Watching the app as it runs — logs, clipboard, screenshots, background behaviour, memory
Platform interaction Exported components, deep links, custom URL schemes, intents, inter-process communication, notifications
WebView security JavaScript bridges, file access, SSL error handling, untrusted content and cross-site scripting inside the app
Cryptography Weak or outdated algorithms, hardcoded keys, fixed initialisation vectors, predictable random values
Tampering and reverse engineering Whether the app can be decompiled, repackaged, hooked or run on a rooted or jailbroken phone
Backend API security Permission checks on the server, excessive data in responses, rate limits, token handling
Business logic Whether steps can be skipped, amounts changed, coupons reused or transactions repeated