Hijacking iOS Deep Links in a Health App Using Custom URL Schemes

Overview During a recent pentest of an iOS health application (let's call it MedVault), I came across something interesting. The app was using custom URL schemes for deep linking but had no Universal