Include Security Research Blog - Team Research blog

How Java’s Immutability Exposes Sensitive Data in Android Apps and Beyond
Introduction
At Include Security we often call out secrets that are hardcoded in application source code as a vulnerability. While most security professionals are aware of the risks posed by typical secret mismanagement, a lesser-known version of the problem exists...

Our consulting team has a large variety of interests outside of security, although that doesn’t mean we take our hacker hats off outside our security work. The AVL (audio, visual, lighting) industry is an area of interest for me as I help run production...

Introduction
One of the most interesting aspects of consulting I see at Include Security is watching the application landscape change over time. Market demands and organizational requirements push the growth of new technologies, features and frameworks, while other...

“I can’t show this to my customers! I need a clean report!”
At Include Security, we put a lot of care into our penetration test reports. But over the years, we’ve noticed that our reports are sometimes interpreted in ways we did not intend. This is understandable. Different people, with different backgrounds...