Security testing
Hands-on tests. Proof you can reproduce.
All security testingHow we workWhat happens after the first call.See the processBuild
We break software for a living. This is what we build.
All build servicesProof of workOur own apps, built the same way.See themAndroid, iOS, macOS and Windows apps, tested on the device and through the APIs behind them. OWASP MASVS and MASTG for mobile, the same depth for desktop.
Anyone can download your app and take it apart. We’ll show you what they’d find.
Out of scope stays out. We ask first.
What the app stores, where, and how well it is protected.
TLS, certificate pinning, and what the app sends to whom.
Login, biometrics, token storage and sessions.
Intents, deep links, URL schemes, IPC and exported components.
Hardening, secrets in the package, tamper checks, updates.
The endpoints the app talks to, tested like any other API.
Platforms, builds, test accounts, and which back end we may use.
The build unpacked and read, with MobSF and Ghidra.
Instrumented devices, with Frida watching storage, IPC and crypto at runtime.
Everything through Burp Suite, and the APIs behind the app tested in full.
Evidence for each finding, mapped to the MASVS control it breaks.
A walkthrough with your developers, then a free retest of the fixed builds.
How a finding reads
| Findings mapped to |
|
|---|---|
| Tools we use |
|
Android, iOS, macOS and Windows. We build our own apps for Android and macOS, so we know them from the inside.
No, a build is enough. Source lets us confirm issues faster and read paths the app rarely runs.
Yes, because a determined attacker will. We also check the app on an ordinary phone, where your users are.
Only if you agree. We prefer staging. If it has to be production, limits and hours go in writing.
Send the scope and your deadline, and we’ll set up a call.
