Certificate pinning is not the wall people think it is

Every mobile engagement starts with someone telling me the app is pinned so the traffic is not interesting. It is always interesting.

Pinning stops a passive observer. It does not stop the person holding the device, and it is not a control against the threat model a bug bounty cares about. Once you are past it, the API underneath is frequently older and more trusting than the web API for the same product — because nobody expected it to be read.