Security reviews we ran against ourselves, a platform change that ate a release, and what it takes to ship a kink app through store review. Written down candidly — the receipts are the point.
We attacked our own app.
Lessons from adversarial security reviews of an end-to-end encrypted relationship app: a forward-secrecy claim we had to retract, a 2^36 reconnect key cracked on paper, a purge that reported success while deleting nothing, and why honest crypto claims beat strong ones.
The keyboard ate the app.
Expo SDK 54 + Android edge-to-edge silently killed keyboard resize on 29 of our 33 input screens. Why per-screen KeyboardAvoidingView patching fails, and how react-native-keyboard-controller actually solves it — including the modal gotcha nobody documents.
A kink app walks into app review.
Can a BDSM lifestyle app get through Apple and Google review? What we learned shipping Devious by DC: content guideline 1.1.4, GDPR Article 9 special-category data, privacy nutrition labels for an E2EE app, and why our monetisation is shaped by data-ownership law.