Industries · Consumer apps

Trust is
the feature.

Social, marketplace, and lifestyle apps live on ratings and word of mouth. One leaked token becomes a headline. Nandee catches it while it's still a pull request.

Scan your appBook a demo
object AvatarCache { fun save(userId: String, img: Bitmap) { val dir = Environment .getExternalStorageDirectory() File(dir, "avatars/$userId.jpg") .writeBitmap(img) } } Any app with storage access can read these. FIX · AVATARCACHE.KT MEDIUM - Environment.getExternalStorageDirectory() + context.cacheDir

What we look for in consumer apps

The bugs that end up
in one-star reviews.

  • Accounts

    Account takeover paths

    Long-lived tokens, password reset links, and OAuth redirects someone else can hijack.

  • Deep links

    Links other apps can fire

    Handlers that trust whatever URL or payload arrives, from a web page or another app.

  • User content

    Photos and messages in the open

    Private media in shared storage, long-lived caches, or guessable public URLs.

  • Third parties

    What your SDKs collect

    Ad, attribution, and chat SDKs, and the personal data they send home.

  • Privacy labels

    What the app really sends

    Know what leaves the device before you fill in the App Store and Play Store forms.

  • Release hygiene

    Debug leftovers in production

    Debug flags, test endpoints, and verbose logging that shipped by accident.

Stores and regulators

Answers for the people
who can pull your app.

App Store and Google PlayRuntime evidence of what the app collects and shares, before you answer the privacy label and Data safety forms.
GDPR and CCPAFind personal data flowing to third parties your privacy policy doesn't mention.
OWASP MASVSEvery finding mapped to a control, for partners and enterprise customers who ask.

Nandee supports your privacy and compliance work. It isn't legal advice.

Example finding

Profile photos in a shared folder.

MediumSAST + DASTMASVS-STORAGE-2 · CWE-922profile/AvatarCache.kt:21

User photos saved to shared external storage

The avatar cache writes every user's photo to a public folder, named by user ID. On devices where other apps hold storage access, those photos are theirs to read.

Before 
20  val file = File(
21    Environment.getExternalStorageDirectory(),
22    "acme/avatars/$userId.jpg")

A public folder, sorted by user.

Suggested fix 
20  val file = File(
21    context.cacheDir,
22    "avatars/$userId.jpg")

App-private. Other apps can't look.

What consumer teams use most

Fair questions.

We release every week. Will this slow us down?

It runs alongside your build in CI. Most weeks you'll hear nothing. When you do, it comes with the fix.

Do you test React Native and Flutter apps?

Yes. Nandee tests React Native and Flutter apps alongside native iOS and Android.

Can it help with our privacy label?

It shows you what the app actually sends and to whom. Filling in the form is still your call.

Five-star reviews never mention security. One-star reviews do.

Scan your app