Invental/ Research

Research.

First-party technical analysis, published because the primary evidence exists nowhere else. What code review catches in real product teams, and malware, code-signing and supply-chain work: the questions where the honest answer is a verifiable fact rather than an opinion.

02 · pieces published Primary evidence only Montevideo, UY

Published

Code review · AI · 12 Oct 2026

What AI code reviewers catch, and what only humans catch

We read 2,675 code-review threads from 165 merged pull requests in 18 open-source product apps. 65% were opened by AI bots. What they caught, what the humans next to them caught, and what still got through.

Invental Research · Snapshot: October Read the report →

Snapshot · Oct 2026 65% bots.
35% humans.

macOS · Code signing · 29 Aug 2026

Can notarized macOS software still be malware?

Yes. Apple's notary service scans the package you submit; it does not constrain what that package does once it runs. A live, signed, notarized installer that passes Gatekeeper with no warning — and fetches its payload as root at install time. With the verification output and the six-line dropper.

Invental Research · 7 min Read the analysis →

Pattern · 01 Notarized.
Still malware.

How this work is done

Code-review research reads public pull requests only, slowly, through GitHub’s API. Examples are described in our own words, with our own code.
Malware work is static analysis only. Samples are unpacked and read. They are never executed, and no request is ever made to attacker infrastructure.
Primary evidence, or it is not published. Every claim here is traceable to a file we hold. Attribution and intent are not evidenced by an artifact, so we do not assert them.
Disclosure first. For security findings, vendors and platforms are notified before anything is published. Live indicators stay redacted until that is done.
Nothing malicious is hosted. No samples, in any form. Hashes and analysis only.
First-party only. We do not accept submissions.

Corrections and takedown

If something here is wrong, we want to fix it rather than defend it. That includes misidentification — a stolen or resold signing certificate makes its registered holder a victim, not a distributor, which is why this section names Team IDs and never people.

Write to hi@invental.co with the page and the specific claim. Corrections are made on the page itself and dated. Takedown requests are read by a person, not a form.

— Invental · software studio · Montevideo, UY