Desktop software development
Desktop software that keeps secrets off disk and logic on the server where it belongs.
- Server enforced business rules
- Protected local storage
- Signed builds and safe updates
- Safe library loading
- Encrypted communication
- Least privilege on the host
The business problem
Desktop applications run where attackers have full control. Anything the client decides on its own can be changed.
Scope of work
Scope is agreed with you before any work starts. A typical engagement covers the areas below, adjusted to your environment, your priorities and any testing windows you need.
- Server enforced business rules
- Protected local storage
- Signed builds and safe updates
- Safe library loading
- Encrypted communication
- Least privilege on the host
Methodology
Security is considered at every stage, not checked at the end.
- Discovery
- Threat modeling
- Architecture
- Secure build
- Code review
- Security testing
- Release
- Support
Typical engagement timeline
Depends on scope. Planned in milestones.
Standards and references
- OWASP ASVS
- CWE Top 25
Tools and techniques
- Cross platform and native stacks
- Code signing
- GARUDX code analysis
- Automated testing
What you receive.
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Benefits
- Fewer vulnerabilities reach production
- Lower cost than fixing after launch
- Security evidence for your customers
- A codebase your team can maintain
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Why us.
- Experienced security professionalsAssessments are led by practitioners who do this work every day.
- Offensive security expertiseWe think like attackers because that is our core discipline.
- Manual validationEvery finding is confirmed by a person before it reaches your report.
- Enterprise focused assessmentsScoping, communication and reporting that fit large organisations.
- Transparent reportingEvidence, reproduction steps and plain language. No padding.
- Actionable remediationSpecific fixes your developers and administrators can apply.
Questions.
Do you security test what you build?
Yes. Every build goes through code analysis with GARUDX and security testing before release.
Can you work with our existing team and stack?
Yes. We can build alongside your developers or deliver a complete product, using the stack that fits the project.
Who owns the source code?
Ownership terms are agreed in the contract before work begins.
Do you support the product after launch?
Yes. Support and maintenance terms are agreed as part of the engagement.