Blog

Field notes on app security.

Engineering deep-dives, threat breakdowns, and honest takes on testing software that ships.

Engineering

Featured

Why we require a proof-of-concept for every dynamic finding

False positives don't just waste time — they train teams to ignore the scanner. Here's how Ares confirms exploitability before it ever raises a finding, and why "reachable + reproducible" is the only bar worth shipping.

8 min read · Aug 2026

Atlas

Parsing six languages into one AST

How a single-pass Tree-sitter walk keeps large-monorepo scans fast without sacrificing depth.

6 min · Aug 2026

Mobile

Reversible APK hardening, explained

SSL-pinning, root detection and integrity checks — injected at bytecode, with a change report you can audit.

7 min · Jul 2026

Safety

Authorization-gated: aggressive testing without targeting the wrong system

Repository approval, DNS ownership, scope allowlists and SSRF guards around an intentionally aggressive staging-only test.

5 min · Jul 2026

SCA

Matching dependencies to CVEs with OSV

Turning a lockfile into an accurate, low-noise vulnerability list using the OSV database.

4 min · Jun 2026

CI/CD

Gating pull requests without slowing the team

Fail only on new criticals, surface SARIF in the security tab, and keep developers moving.

6 min · Jun 2026

Threat model

A deterministic STRIDE model from your code

Deriving trust boundaries and data flows automatically — and where an LLM actually helps.

9 min · May 2026

Get new posts in your inbox

Occasional, technical, no spam.

sentesting