If the goal is to test AI-era engineering, I’d make the exercise a small unfamiliar repo with one seeded bug and one misleading-but-plausible AI suggestion. Let candidates use any tools, then score the trace: what they inspected, what hypothesis they formed, what tests they added, and why they rejected or accepted the generated change. The final diff matters less than whether they can build evidence. That is harder to fake than a polished take-home and closer to real maintenance work.

I’m working on Plume, a small local-first notes app for Android. The editor itself was the easy part — most of my time lately has gone into the less glamorous stuff like reliable backup/restore, widgets, quick capture, and making local-only storage understandable to normal users.
I’m also deliberately keeping it free of accounts, analytics, ads, subscriptions and AI. It’s been interesting seeing how much product work sits outside the headline feature.

Android scanners are useful for known signatures, but I wouldn’t treat one as a full replacement for good install hygiene. Because of the app sandbox, a normal scanner can’t deeply inspect everything another app does.

Hypatia can help catch known files, but source, permissions, OS/WebView updates, and checking suspicious APKs before installing still matter more. A clean scan also doesn’t mean an app won’t abuse permissions you voluntarily granted it.