Secure Kotlin Banking App

I’m building a banking-domain Android application written entirely in Kotlin with Jetpack Compose and I need help reinforcing its security layer while finishing the first functional module: an Account Balance Inquiry screen.

Scope of work
• Integrate SSL pinning so the app accepts traffic only from my authorised backend certificates.
• Encrypt all sensitive data at rest and in transit; I’m leaning on AES/Keystore for local storage but I’m open to stronger approaches if you have proven experience.
• Add BiometricPrompt-based authentication to gate access to the balance screen and any subsequent flows.
• Compose UI for the balance inquiry, wired to a simple REST endpoint I’ll provide.

Tech stack & expectations
– Kotlin, Jetpack Compose, Coroutines/Flow
– OkHttp or equivalent with certificate pinning capability
– AndroidX Security Crypto (or your recommended library) for encryption
– Clean, modular code with unit tests around the security components
– Clear README explaining how to swap certificates and keys for future releases

Acceptance criteria
1. App fails gracefully when the server certificate does not match the pinned hash.
2. All locally stored tokens or cached balance data remain encrypted; static analysis (MobSF) should flag no plaintext leaks.
3. Biometric authentication blocks access until a valid fingerprint or face scan is provided.
4. Successful build and run on Android 13+, no warnings in Play-ready security checks.

Drop a brief note on your prior SSL-pinned or encrypted Android apps, and include a GitHub snippet or APK demonstrating these exact features if possible.