Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.

Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.

Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.

Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.