Security testing
Hands-on tests. Proof you can reproduce.
All security testingHow we workWhat happens after the first call.See the processBuild
We break software for a living. This is what we build.
All build servicesProof of workOur own apps, built the same way.See themAndroid and iOS apps that ask only for the permissions a feature needs. Aegis, our own Android app, is in early access.
Designed against OWASP MASVS, OWASP MASTG and NIST SSDF.
App binary
It will be taken apart. No secrets in the app, every rule enforced on the server.
Permissions
Only what a feature needs, asked for when it needs it.
On the device
Secrets in the Keystore or Keychain. Nothing sensitive in backups or logs.
Network
TLS only, cleartext blocked, pinning where the risk is worth the upkeep.
Your API
Tokens scoped to one user, checked on every request.
Third-party code
No ad or analytics SDK unless you decide you need one.
Your app runs on a phone you don’t control, in the hands of anyone who downloads it. We design for that from the first screen.
Kotlin for phones and tablets, with Java where a codebase or library needs it.
Swift and SwiftUI for iPhone and iPad.
Capacitor or React Native when one codebase is the right trade, native code where the platform needs it.
On-device processing, the fewest permissions, and data that leaves only when the user says so.
Tokens, rate limits and authorisation designed for a client that will be taken apart.
Permission and privacy declarations written from what the code actually does.
Android
KotlinJava
Kotlin for new work. Java where a codebase needs it, as in Aegis’s native plugin.
iOS
SwiftSwiftUI
The Keychain and the privacy prompts used the way Apple intends.
Cross-platform
CapacitorReact Native
One codebase for both platforms, native code where it has to be.
Tools we use: Android Studio, Xcode, MobSF and Frida.
Native Kotlin and Swift when the app leans on the platform: background work, sensors, a demanding interface. Capacitor or React Native when one codebase serves both well. You’ll know which before we quote.
Mostly by collecting less of it. Data stays on the device unless it has to leave, secrets go in the Keystore or Keychain, and traffic is TLS only.
Android, iOS or both, and when it has to be in the stores. You get a written quote.
