Application Security
Security built into how software is designed, written and shipped — from threat modelling to verifying the code holds up.
ABT
Software studio & security engineering · Est. 2024
Open for new engagements
Innovative solutions, reliable software.
We ship privacy-first apps of our own — and bring the same security, AI and engineering discipline to your team: advisory, hands-on implementation and assessments.
06
Fields of practice
03
Engagement modes
03
Live apps
Six fields. Three ways to engage.
Rather than a menu of line items, we work across a handful of connected fields — and engage at whatever depth you need: shaping the strategy, building it, or proving it holds.
Advise
Architecture reviews, threat models, maturity assessments and roadmaps your team can act on.
Build
Hands-on engineering: pipelines, integrations, controls, automation and software, delivered working.
Test
Penetration testing and security assessments with reproducible findings and clear remediation.
DevSecOps & Supply Chain
Pipelines that catch problems before production: security gates, hardened infrastructure-as-code and a software supply chain you can trust.
ABT
AI Security
Securing LLM applications, agents and RAG systems — guardrails and access control in, prompt injection and data leakage out, verified by red teaming.
ABT
AI Engineering
Putting AI to work inside existing products and processes: integrations, agents and MCP servers that are useful, observable and cost-efficient.
ABT
Observability & Detection
Knowing what your systems are doing and when something is wrong — monitoring, centralised logging, alerting and detection that is actually validated.
ABT
Software & Automation
APIs, backends, web, desktop and mobile apps — plus automation that removes repetitive work across the tools your teams already use.
ABT
155 services across these fields · scope tailored to your environment
Request the full catalog →Three apps, one philosophy.
Quiet utilities and sharp little games. Built to respect your time and your data.
001
Privacy utility
Secrefier
Encrypt and obscure sensitive notes on device. Nothing leaves your phone — not even to us.
002
Puzzle game
Mind Warrior
A daily logic battle. Train pattern recognition, memory, and reflex in five‑minute matches.
003
Word game
Linkaword
Chain words by their hidden links. A meditative vocabulary game for commutes and queues.
Security is the spine, not a feature.
The principles behind our own apps are the ones we bring to client work.
# Every change passes the same gates.
on: [pull_request]
jobs:
security:
steps:
- run: sast --fail-on high
- run: sca --sbom out/sbom.json
- run: secrets-scan --block
- run: iac-scan ./infra
- run: sign --artifact dist/
# Merge only when every gate is green.
01 / Principle
Secure by design
Threats are modelled before code is written. Controls are designed in, not bolted on.
02 / Principle
Automated, not aspirational
Security gates live in the pipeline: scanning, signing and policy checks run on every change.
03 / Principle
Privacy by default
If data doesn't need to leave a device or a boundary, it doesn't. Collection is opt-in.
04 / Principle
Evidence over assurance
Findings come with reproduction steps, severity and a fix path — mapped to OWASP and MITRE where it applies.
One studio, two sides.
Mergenware is an independent software studio. On one side, we design and ship our own privacy-first mobile apps and games. On the other, we help teams secure, build and automate their software — across application security, DevSecOps, AI security and engineering, observability and custom development.
The name comes from Mergen, the archer of Turkic myth — precision is the point. Every engagement and every release is held to the same standard: secure by design, built to last, and honest about what it does.
Products
3 live apps on iOS & Android
Services
6 fields · 155 services
Engagements
Advisory · Implementation · Assessments
Languages
English · Türkçe
Start a project
Have something to secure, build or automate?
Tell us about the system and the outcome you need. We'll come back with a scoped proposal.
Get in touch
Tell us what you're working on.
General inquiries, security reports, press, partnership — all welcome.