Social Media Ideas for Application Security

Your Application Has an Unindexed Attack Surface. Do You Know What’s in It?

Security teams usually describe an application through the assets they know about. This includes the production domain, documented APIs, the services currently in use, and the repo...

Building an Android APK Protection Platform Against Reverse Engineering

Building an Android APK Protection Platform Against Reverse Engineering Android applications are relatively easy to inspect after an APK is obtained. With the right tools, devel...

Staff Android Interview Questions: Security & Privacy

The security questions that test whether an Android engineer can protect users, data, and the business not just implement authentication.Continue reading on Medium »

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protecti...

Governing Enterprise Mobile Application Ecosystems

Today, it is common for enterprise organizations to manage corporate mobile apps across smartphones, tablets, personal (BYOD) devices, and shared devices, and different kinds of co...

Secure Application Development: Building Speed, Compliance, and Control into Every Release

Secure application development should support innovation without weakening compliance or enterprise control. This blog explains how risk-tiered governance, DevSecOps evidence, cont...

SafetyNet Is Dead: Detecting Tampered Devices with Play Integrity API

The migration every banking app was forced to make, and why the client-side token is only half the jobContinue reading on Medium »

Building Mobile Device Security Standards Across Apple and Android Environments

Most organizations handle a mix of devices (such as iPhones, iPads, Android smartphones, tablets), making it difficult to manage every single one using just one framework. Addition...

Keeping Your App’s Secrets Safe: A Simple Guide to Mobile Storage

Where your login tokens, keys, and user data actually belong — without confusing jargon.Continue reading on Medium »

AndroidX Security State Goes Stable: Check Patch Levels, Pending Updates and CVEs in Kotlin

If your app has ever had to answer “is this phone patched enough to trust?”, you know the usual answer is a mess: read…Continue reading on Medium »

The Hidden Production Risks of Third-Party SDKs

Most modern applications do not function completely independently. For example, analytics, payment processing, user authentication, customer support, testing new features (experime...

Hot Cell v1.0: Securing Active Storage in the age of AI

Originally appeared on 37signals Dev.Today we are releasing Hot Cell v1.0, a suite of gems that moves Active Storage’s attachment processing out of your Rails application and into...

Secure AI Systems: Defending Enterprise Applications Against Agent-Era Threats

The rise of autonomous AI agents within business software demands a fresh approach to security. Unlike earlier chatbot tools, modern agents act with real privileges, such as updati...

A Security Collection for the Security Chapter

Why mission-critical mobile is a state rather than a device

Michael Covington, Vice President of Strategy at Jamf, tells ISJ about how business should be applying proportionate security controls. Mission-critical systems are the ones an org...

AndroidX Security State Libraries: A Simple Guide

Not a Medium Member? “Read For Free”Continue reading on Android Lab »

7 Android Security Mistakes That Hide in Otherwise Good Code

Real vulnerability reports, overlooked platform behavior, and practical fixes for code that looks ready to ship.Continue reading on Medium »

Any App on the Phone Can Launch Your Android Screen Directly.

An exported component skips your login flow entirely. Another app can start your internal screen, send it whatever data it wants, and read…Continue reading on Medium »

Best Veracode Alternatives for Modern AppSec Teams

Application security has changed dramatically over the last few years. Development teams are releasing code... The post Best Veracode Alternatives for Modern AppSec Teams appeared...

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance

Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give...

Is that vibe coded app safe? 5 checks before you download

As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data

LLM Security: OWASP Top 10 for LLMs 2026 and How to Test It

LLM security explained: the OWASP Top 10 for LLM Applications 2026, how it differs from LLM safety, and one test per risk with the evidence that decides it.

Why Continuous Application Security Testing Is No Longer Optional

Your last pentest is already out of date. The moment you shipped new code after that report, your risk profile changed, and nobody re-tested it.  That's the reality most teams are...

Part 11 — App Fundamentals & Structure

Android Interview Prep — Complete IndexContinue reading on Stackademic »