Teardowns of how apps handle secrets, encryption, integrity checks and their own code.
On September 30, 2026, Android developer verification began in Brazil, Indonesia, Singapore and Thailand. Apps installed from seven participating stores on certified devices must be registered to a developer whose identity Google has verified. Google plans a global rollout in 2027.
On September 24, 2026, UpGuard reported 16,326 Supabase databases exposing readable tables, among about 300,000 websites with Supabase indicators in their JavaScript. Over half had indicators of personal data. The sample is websites; Supabase mobile apps contain the same kind of URL and key.
Apple's iOS 27 security notes, released September 14, 2026, list 126 CVE IDs. Fourteen entries describe an app obtaining persistent identifiers, fingerprinting signals, the list of installed apps, location from system logs, cross-app tracking or Privacy preferences. iOS 26.7 fixes seven of them.
I monitored device setup flow, scanning the room, the map, AI features, voice commands on both the vacuum cleaner and on the iOS app. The product respects user privacy better than most but it could have been better. Default dangerous features are off with a consent screen for each.
I decompiled the Temu app on both platforms. On Android it erases all ten of its own native libraries from the file security scanners read, rewrites its own Java methods under a server flag, and seals its telemetry with a home-grown cipher that has no extractable key.
I decompiled the Google Play “Trump Accounts” app, listed under U.S. Department of the Treasury. It's a Robinhood wrapper compiled as an internal “Golden Eagle” flavor.
On April 9, 2026, Microsoft detailed an intent redirection flaw in the EngageLab Android SDK: the exported MTCommonActivity let another app on the same phone obtain read and write access to the host app's private files. Wallet apps with the SDK had over 30 million installs. Version 5.2.1 fixes it.