I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps.
Frankly, the applications I test are critical bank applications and I can listen to the traffic passing through these applications.
Do you think I should post this as a vulnerability finding? I did a research for about a day, but I couldn't find any clear idea about tightening methods. If I have to write it as a finding, what are the tightening methods and solution suggestions? Can you help me?