Developer for Android app security issues

Hello Guys,
Please find the issues I am facing given below
1- IDOR -no rate limit -
For single request only 5 limit rate and otp

2- App should not run on rooted device it's should not bypass also

3-Security Misconfiguration
missing security headers
server banner
cookie attribute not set

4-Used Old JWT and JWT token expiretion not set

thank you