# Blog | OxiSoft

> Why we build the way we do.

Canonical: https://oxisoft.io/blog/

- [A CVE count is not a risk score: reachability in Go](https://oxisoft.io/blog/cve-count-is-not-a-risk-score/): A scanner that counts CVEs in your go.mod tells you what you have, not what you run. How govulncheck checks if your code can reach the vulnerable function.
- [Metadata is data: what leaks even when messages are encrypted](https://oxisoft.io/blog/metadata-is-data/): Encryption hides what you say, not who you talk to, when, how often or from where. Why metadata reveals more than content, and what apps can do about it.
- [Data that is never collected cannot leak](https://oxisoft.io/blog/data-never-collected-cannot-leak/): Encryption, firewalls and audits all help, but the strongest security control is simpler: don't keep the data. Why data minimisation beats every defence.
- [Flutter on Desktop: What Broke on Windows, macOS and Linux](https://oxisoft.io/blog/flutter-desktop-in-production/): Shipping one Flutter game to three desktop systems taught us where the code really differs. Video, store packaging, rendering and window size, with the fixes.
- [Go or Rust? How We Pick the Language for Each Project](https://oxisoft.io/blog/go-or-rust-how-we-choose/): We ship both Go and Rust. The choice is rarely about speed. It comes down to where the code will live: on a server of its own, or inside an app on every device.
- [What is inside our apps: a dependency audit](https://oxisoft.io/blog/whats-inside-our-apps/): We say our apps have no tracking, no ads and no crash reporting. Here are the real dependency lists of three shipped apps, so you can check that claim.
- [F-Droid and what it means to own your data](https://oxisoft.io/blog/fdroid-own-your-data/): Owning your data is not a setting you switch on. It starts with where the app came from, what it stores, and whether it needs an account at all.
- [One payment instead of a subscription: the honest tradeoff](https://oxisoft.io/blog/one-payment-instead-of-subscription/): Habit Observer sells one PRO unlock instead of a monthly plan. Here is what that choice costs us, what it gives the user, and when it is wrong.
- [Your Android app should work without Google Play Services](https://oxisoft.io/blog/android-app-without-google-play-services/): Many Android apps quietly assume Google Play Services is installed. Here is what breaks when it is missing, and how to degrade instead of crash.
- [Why Rust Is the Best Language for Vibe Coding](https://oxisoft.io/blog/rust-for-vibe-coding/): Vibe coding is only as safe as the thing checking the output. Rust ships the strictest checker in mainstream use, which makes it a surprisingly good fit for AI-written code.
- [We Let an AI Agent Do QA on Real Hardware](https://oxisoft.io/blog/ai-agent-android-qa/): An AI agent tests our apps on a physical phone instead of an emulator. What it catches, what it costs, and where the approach stops being worth it.
- [Triple Space Is Out on Google Play, With Nothing Attached](https://oxisoft.io/blog/triple-space-on-google-play/): Our space merge puzzle is live on Android. Merge three alike to build moons, planets and black holes. No ads, no tracking, no account, works offline.
- [Why We Build with Go, Flutter, and Rust](https://oxisoft.io/blog/why-we-use-go-flutter-rust/): Go for backends and tools, Flutter for cross platform apps, Rust for the hot paths. Here is why each language earns its place in the work we ship.
- [OxiType: the Typing Game That Makes You Faster by Accident](https://oxisoft.io/blog/oxitype-typing-game/): OxiType is a cyberpunk arcade typing game. Shoot down word-carrying alien ships, survive 80 levels, and get faster without ever opening a typing course.
- [AI-Driven Development with Claude Code: A Security and Privacy Argument](https://oxisoft.io/blog/ai-driven-development-with-claude-code/): Why AI-assisted coding with Claude Code often produces more secure and privacy-respecting software than manual engineering, and where it doesn't.
- [Why OxiSoft Apps Don't Track You](https://oxisoft.io/blog/why-we-dont-track-users/): Privacy-first app development isn't a feature you add. It's an architecture choice that rules out entire categories of revenue, SDKs, and convenience.