Mike Sanderson

Open to contract iOS and security work

Shipping iOS apps since 2013, with an eye for where they leak.

Apple Wallet’s NFC launch in 2015. Face ID in an encrypted messenger. An authentication bypass I found in a health app. Four public comments to NIST. Now I build with AI agents, and check their work.

Email me CV hello@mikesand.ai
Mike Sanderson
Mike Sanderson in 2013, holding the MTA and AT&T AppQuest certificate: Winner 2013, Third Prize.
Where it started: my team’s AccessWay app took 3rd prize at MTA App Quest 2013, then grew into Smart Subway AR.
Screen recording frame: the Face Not Recognized dialog fading over the One Medical app’s Security Message thread, which should have been hidden. The staff member’s name is blurred.
5.625 s into my 8-second recording: Face ID has failed, yet the private screen it should have hidden flashes into view.

April 2021 · Found in the wild

An authentication bypass in One Medical’s iOS app

In April 2021 I found that the One Medical app bypassed its own authentication: returning it from the background, after failed Face ID attempts, it flashed the last private screen for about a quarter of a second. Anyone with the phone could capture it with screen recording. I recorded it and reported it, and One Medical’s team followed up. The recording even caught their security thread.

  1. 5.59 s
  2. 5.64 s
  3. 5.71 s
  4. 5.79 s
The dialog fades out, the thread fades in, then both are gone.

Read the write-up

2026 · In development

Robot’s Rules

A parliamentarian in your pocket: an iPhone and iPad app that knows which motions are in order. SwiftUI and SwiftData, built with Claude Code.

robotsrules.com · More on the project

2026 · Public comments

Comments to NIST

On NIST’s OSCAL white paper, its National Checklist Program, the Secure Software Development Framework, and its AI quick-start guide for CSF 2.0, from a working developer’s point of view.

Read the comments