Blog
About this blog
This blog covers application security as it turns up in real assessments: mobile app hardening, API authorisation, web access control, cloud blast radius, secure coding practice and the compliance questions Indian product teams get asked. 18 posts, each dated and revised when the advice changes.
Latest
For a small product team, the Digital Personal Data Protection Act reduces to five engineering obligations: keep an inventory of personal data, collect and record consent for each purpose, delete data on request and when its purpose ends, report breaches to the Data Protection Board and affected users, and apply reasonable security safeguards.
Read the postMobile security · 4 min read
Twenty checks, grouped the way an attacker looks at an app: what ships inside the package, what lands on the device, what crosses the network, and what the server accepts.
Mobile security · 4 min read
The Top 10 is written platform-agnostically. Here is what each risk looks like in a real Flutter project, and which package choice usually causes it.
API security · 3 min read
Five findings appear so consistently that I now test for them in the first hour of any API engagement. Each has a one-paragraph fix.
Practice · 2 min read
Security spend fails when it arrives in the wrong order. Here is what buys the most risk reduction at each funding stage, with indicative rupee figures.
Mobile security · 4 min read
Pinning fails in one of two ways: not implemented, or implemented so tightly that a routine certificate renewal takes the app offline for everyone who has not updated.
Scope and a fixed quote within two working days. First consultation is free.