Qubin GmbH designs and ships cross-platform software with Kotlin Multiplatform and Compose Multiplatform, and builds the secure local tooling that lets AI coding agents operate real release infrastructure without ever touching a raw credential. We prove both in production with our own apps — including NailMe, Craft and Hair.
Alongside client and internal engineering work, we run our own marketplace apps as a production testbed: booking, chat, portfolios and reviews, reskinned per industry.
Find and book nail studios, browse real portfolios, and preview nail shapes and designs with AI-assisted try-on before you book.
A marketplace for home-improvement pros — kitchen, bathroom, garden and living-room projects — built on the same booking and chat foundation as NailMe.
Booking and discovery for hair salons and stylists, using the same reliable core: real-time availability, chat, and portfolios of past work.
Over a decade of mobile app experience taught us the cost of maintaining two separate native codebases. Every Qubin brand — nails, craft, hair — ships from one Kotlin Multiplatform + Compose Multiplatform codebase, so a feature built once reaches Android and iOS at the same time.
That's also why our own products double as a proving ground: real production apps, real users, real App Store constraints — not a demo.
Shared business logic, ViewModels and repositories across Android and iOS with Compose Multiplatform UI.
Self-contained feature modules with their own UI, ViewModel, DI and navigation — reused across all four brand variants.
GitLab CI pipelines build, test and distribute every variant to Firebase App Distribution and TestFlight automatically.
We're building AI-assisted software delivery into our own pipeline — and the one rule we won't compromise on is that the AI never sees a raw credential.
Giving an AI coding agent access to production infrastructure is a real security problem: publishing to Google Play or the App Store, pushing to Git, or deploying to Firebase all depend on credentials that are catastrophic if leaked — service-account JSON files, signing keystores, API keys, SSH keys.
Our approach, described in full in how we let AI agents ship our apps without ever seeing a secret, follows one core principle:
The AI can request a capability, but it never receives the underlying secret.
Instead of an agent reading GOOGLE_SERVICE_ACCOUNT_JSON or an SSH private key directly, it requests a narrowly scoped operation — google_play.publish — and a local, trusted executor resolves that request against a credential store the AI process can never read.
Publishing credentials for Google Play, App Store Connect, Firebase, GitLab and RevenueCat are stored as project-scoped handles in the macOS Keychain — never in environment variables or plain files an agent could read.
An agent asks for a handle like nails.google-play.production. The real secret is only ever materialized inside a short-lived, auto-shredded subprocess — the value never reaches stdout, a log, or the model.
Each capability request is logged with what was requested and when — without ever recording the secret itself — so credential use stays traceable.
We wrote up the credential-handle model, the local provisioning agent, and how it validates real signed access (Google Play RS256, App Store Connect ES256) without ever exposing a key.
How we secure AI-driven app releasesWe bring the same engineering that runs NailMe, Craft and Hair to teams who want to consolidate their Android and iOS codebases.
Shared codebases for Android and iOS with Kotlin's multiplatform capabilities — save time and budget without sacrificing native quality.
Modularization for scalability and maintainability — flexible feature-module architectures that evolve with your product.
Fully automated build, test and release pipelines using GitLab CI, Firebase App Distribution and the App Store / Play Store release process.
Notes on building our apps and the industries they serve.
A tour of booking, chat, portfolios and AI-assisted nail design previews.
Read article →Credential handles, a local Keychain-backed executor, and why the AI only ever gets a capability, never a key.
Read article →The architecture behind nails, craft and hair sharing a single Compose Multiplatform core.
Read article →Questions about NailMe, Craft, Hair, or interested in Kotlin Multiplatform for your own product?