https://cs.abinantony.io/blog Articles on mobile, web, API and cloud security from Abin Antony. en-IN Wed, 19 Aug 2026 00:00:00 +0530 https://cs.abinantony.io/blog/dpdp-act-for-product-teams https://cs.abinantony.io/blog/dpdp-act-for-product-teams Tue, 11 Aug 2026 00:00:00 +0530 Compliance The Act is short, and most of what it asks a product team for is engineering work you can do in a sprint: know what you hold, prove consent, delete on request, notice a breach. https://cs.abinantony.io/blog/mobile-app-security-checklist https://cs.abinantony.io/blog/mobile-app-security-checklist Tue, 28 Jul 2026 00:00:00 +0530 Mobile security Twenty checks, grouped the way an attacker looks at an app: what ships inside the package, what lands on the device, what crosses the network, and what the server accepts. https://cs.abinantony.io/blog/owasp-mobile-top-10-for-flutter-teams https://cs.abinantony.io/blog/owasp-mobile-top-10-for-flutter-teams Tue, 14 Jul 2026 00:00:00 +0530 Mobile security The Top 10 is written platform-agnostically. Here is what each risk looks like in a real Flutter project, and which package choice usually causes it. https://cs.abinantony.io/blog/api-security-mistakes https://cs.abinantony.io/blog/api-security-mistakes Tue, 30 Jun 2026 00:00:00 +0530 API security Five findings appear so consistently that I now test for them in the first hour of any API engagement. Each has a one-paragraph fix. https://cs.abinantony.io/blog/security-budget-for-indian-startups https://cs.abinantony.io/blog/security-budget-for-indian-startups Fri, 12 Jun 2026 00:00:00 +0530 Practice Security spend fails when it arrives in the wrong order. Here is what buys the most risk reduction at each funding stage, with indicative rupee figures. https://cs.abinantony.io/blog/certificate-pinning-without-breaking-your-app https://cs.abinantony.io/blog/certificate-pinning-without-breaking-your-app Tue, 26 May 2026 00:00:00 +0530 Mobile security Pinning fails in one of two ways: not implemented, or implemented so tightly that a routine certificate renewal takes the app offline for everyone who has not updated. https://cs.abinantony.io/blog/broken-access-control https://cs.abinantony.io/blog/broken-access-control Fri, 08 May 2026 00:00:00 +0530 Web security Frameworks solved authentication a decade ago. Authorisation is still hand-written per endpoint, which is why the same finding leads report after report. https://cs.abinantony.io/blog/jwt-mistakes-in-mobile-backends https://cs.abinantony.io/blog/jwt-mistakes-in-mobile-backends Fri, 17 Apr 2026 00:00:00 +0530 API security A JWT is a signed claim, not a session. Treating it as one produces tokens nobody can revoke and a logout button that logs nobody out. https://cs.abinantony.io/blog/iam-blast-radius-review https://cs.abinantony.io/blog/iam-blast-radius-review Tue, 24 Mar 2026 00:00:00 +0530 Cloud security A compliance score tells you which policies are untidy. A blast radius review tells you what happens when one CI key leaks — which is the question you actually need answered. https://cs.abinantony.io/blog/answering-a-security-questionnaire https://cs.abinantony.io/blog/answering-a-security-questionnaire Fri, 27 Feb 2026 00:00:00 +0530 Compliance The instinct is to answer yes to everything and hope nobody checks. Reviewers check, and a caught overclaim costs more than every honest no combined. https://cs.abinantony.io/blog/secrets-in-git-history https://cs.abinantony.io/blog/secrets-in-git-history Fri, 30 Jan 2026 00:00:00 +0530 Secure coding Deleting a key in a later commit does not remove it. The only response that counts is rotation, and the only prevention that works runs before the commit lands. https://cs.abinantony.io/blog/logs-you-will-want-after-an-incident https://cs.abinantony.io/blog/logs-you-will-want-after-an-incident Thu, 08 Jan 2026 00:00:00 +0530 Cloud security During an incident you cannot add logging retroactively. Every question you will be asked depends on events you either recorded beforehand or did not. https://cs.abinantony.io/blog/threat-modelling-a-payments-flow https://cs.abinantony.io/blog/threat-modelling-a-payments-flow Mon, 15 Dec 2025 00:00:00 +0530 Practice Threat modelling gets skipped because it sounds like a two-day workshop. Here is the ninety-minute version, run on the flow that carries your money. https://cs.abinantony.io/blog/rate-limiting-otp-abuse https://cs.abinantony.io/blog/rate-limiting-otp-abuse Thu, 20 Nov 2025 00:00:00 +0530 API security A four-digit OTP with a per-IP limit is not protected. It is protected against one attacker on one connection, which is not the attacker you have. https://cs.abinantony.io/blog/what-a-scanner-misses-in-android-apps https://cs.abinantony.io/blog/what-a-scanner-misses-in-android-apps Tue, 28 Oct 2025 00:00:00 +0530 Mobile security A mobile scanner report reads alarmingly and usually contains nothing severe. Everything severe requires a second account, a device and a person. https://cs.abinantony.io/blog/pentest-or-code-review https://cs.abinantony.io/blog/pentest-or-code-review Tue, 30 Sep 2025 00:00:00 +0530 Practice They answer different questions. Which one to buy depends on whether you need to know what an attacker can do today, or why it was possible in the first place. https://cs.abinantony.io/blog/password-reset-flows https://cs.abinantony.io/blog/password-reset-flows Thu, 18 Sep 2025 00:00:00 +0530 Web security Nobody attacks your login form. They attack the flow that issues credentials to whoever holds an email address — which is usually written once and never reviewed. https://cs.abinantony.io/blog/pull-request-security-checklist https://cs.abinantony.io/blog/pull-request-security-checklist Fri, 22 Aug 2025 00:00:00 +0530 Secure coding A forty-item security checklist gets ticked without being read. Seven questions, asked only when they apply, get answered honestly.