Our Flutter app kept the login token in SharedPreferences, wrote it to the device logs and allowed Android backups. None of it was obvious until a security review. Here is what we changed, with the code.
Before paying for a pentest, you can find most of the obvious problems in your AWS account yourself with read-only CLI calls. Here is the checklist I run, what each check looks for and how to keep it safe for production.
govulncheck only reports vulnerabilities your code can actually reach, which makes the output short enough to act on. Here is how I run it, why I scan the built binary and how a fixed vulnerability came back because of the Go version in go.mod.
If a password ever went into the environment block of an ECS task definition, it is still readable in every old revision, even after you deregister them. Here is how to find those revisions, the order to fix them in and how to stop it happening again.
A single VAPT run tells you what is broken today. Comparing it with the previous run tells you which fixes did not hold. Here is the simple findings format and the small python script I use to diff two runs.
