A PWA combines HTTPS, a web app manifest, a service worker and a responsive interface. Installation happens through the browser; feature availability depends on platform and operating system.
A PWA is neither inherently insecure nor equivalent to a native app. The security model, update path, permissions, browser engine and push behaviour must be assessed for each target platform.
Three verification questions
- 01Are manifest and service worker scoped and versioned?
- 02Which features are unavailable on target platforms?
- 03How are updates and offline data controlled?