iOS engineering and application security
Swift, SwiftUI, device integrity, App Attest, authentication flows, Keychain, Secure Enclave, transport and secure storage boundaries.
App Attest: server-side failure modesFounder / Engineering profile
Jeffrey Monica
Founder of Demonic Binary. I build and troubleshoot iOS, Android and backend systems, assess software security boundaries, and turn findings into tested engineering changes.
Jeffrey Monica is also known as Jeffrey Martin Monica and Jeff Martin. These are names for the same person, not separate contributors or companies. I founded Demonic Binary, a California-based software engineering and cybersecurity practice.
What I work on
My work spans native iOS and Android applications, secure authentication, API integration, platform reliability and adversarial security analysis. I investigate how systems actually behave: requests crossing trust boundaries, sessions surviving unexpected conditions, privileged components handling untrusted input, and releases diverging from what was tested. I focus on the implementation, the failure path and how to verify the fix.
I use Swift, Kotlin and the platform tools around them; backend and network diagnostics, automated testing, runtime instrumentation, debuggers and reverse-engineering tools where the scope calls for them. Red teaming and low-level security research require explicit authorization, qualified resources and a defined test boundary. A public service description is not proof of a specific exploit discovery or government engagement.
Technical focus
These are areas of engineering practice and research interest, with published technical reading linked below. Company research is attributed to its actual author or publisher; this profile does not claim sole authorship of every article.
Android engineering and system security
Kotlin, Jetpack Compose, device trust, Play Integrity, Credential Manager, privilege boundaries and authorized platform testing.
Play Integrity: backend verdict policyBackend and platform security
API authorization, session lifecycle, distributed workflows, network diagnosis, release integrity, observability and production debugging.
API authorization: object-level boundariesReverse engineering and defensive research
Security review, protocol analysis, native-code debugging, Ghidra, LLDB, attack-surface analysis and scoped red-team assessment with written permission.
Benign malware research methods and evidenceEngineering evidence and reading
Selected public work from Demonic Binary. Each page explains its scope, what was actually tested and which findings remain illustrative or synthetic. Client-sensitive information is excluded.
Runnable authorization boundary lab
A synthetic tenant/object test demonstrating an unsafe request path, an enforced authorization boundary and repeatable negative tests.
iOS and Android mobile security test matrix
Practical controls and failure cases for mobile application and backend releases; no unsupported OWASP certification claim.
Platform and deployment incident analysis
Technical investigation and review of request routing, deployment artifacts and verification boundaries.
Offline detection tool validation
Harmless YARA/Sigma fixtures, documented limitations and repeatable verification instead of invented malware case studies.
Personal profiles and company links
These are my personal public profiles, separate from the Demonic Binary company accounts below. They identify the same person as Jeffrey Monica, Jeffrey Martin Monica and Jeff Martin.