Architecture reviews, security audits, and bring-up triage for teams shipping Android on custom hardware. We read the code your team does not have time to, and we write a report with prioritised findings and references you can act on.
Architecture reviews covering the full stack — bootloader, kernel, HAL, framework, and app layer — with prioritised findings, reproduction steps, and references to the AOSP commits and vendor docs behind each recommendation.
Security audits: SELinux policy reviews, verified-boot chain walkthroughs, keystore and attestation assessments, and third-party SDK triage — beyond what CTS and Play Protect check for.
Bring-up triage on stuck hardware — kernel, init sequence, HAL, or first-boot regressions — delivered as a short, targeted engagement rather than an open-ended retainer.
Due diligence for platform hiring and acquisitions: tech-screen support, codebase reads, and written opinions with references you can hand to stakeholders.
A free 45-minute conversation. We read your architecture doc, your repo README, or the specific ticket you are stuck on. If it is not a fit, we say so and point you somewhere better.
Within two to three business days: objectives, deliverables, hourly estimate, and a fixed ceiling. You approve, adjust, or walk away — no retainer pressure.
We read, we test, we reproduce. You get substantive updates every two to three days — specific findings with line numbers, not weekly status theatre.
A written report with prioritised findings, reproduction steps, and references to AOSP, CVE, and vendor documentation. One hour of follow-up Q&A included; remediation is optional and scoped separately.
Before an AOSP device ships we read the security posture — SELinux policy, verified-boot chain, keystore, attestation — plus the OTA pipeline. You get a written report with prioritised findings and reproduction steps.
When a new board or SoC is blocking a release, we do focused triage: kernel config, init, HAL, first-boot. Written findings with reproduction steps, not an open-ended retainer.
Device-owner posture, verified boot, attestation chain, and third-party SDK triage across a deployed fleet. Output is a remediation roadmap with priorities, not a compliance checklist.
Tell us what you're building and where you're stuck. We read every message, and we reply with an honest assessment — even when we think someone else is a better fit.