2026-11-06 / ORIGINAL RESEARCH
OWASP MASVS test matrix for iOS and Android releases
Map OWASP MASVS control groups to iOS and Android storage, authentication, platform, privacy and backend release verification.
Read the analysisENGINEERING JOURNAL / ORIGINAL WRITING
Technical writing from the work itself.
Auth failures, release mistakes, architecture boundaries and the decisions behind the fixes. Read the investigations, design choices and code-level lessons.
BROWSE / TECHNICAL SUBJECTS
Pick the boundary you're investigating.
iOS, Swift & app integrity
Native iOS architecture, App Attest server validation, session lifecycles and responsible releases.
Explore topicAndroid, Kotlin & Play Integrity
Android integrity verdict policy, authenticated API contracts and lifecycle-aware recovery.
Explore topicMobile application security
A joint view of iOS, Android, device evidence, identity, abuse paths and reporting.
Explore topicBackend APIs & authorization
Object permissions, tenant isolation, async execution, identity propagation and testable enforcement.
Explore topicPlatform & release integrity
Build provenance, CI/CD authority, Cloudflare routing, operational visibility and rollback.
Explore topicRESEARCH / TECHNICAL ANALYSIS
Published investigations
2026-11-06 / ORIGINAL RESEARCH
API tenant-isolation regression tests for BOLA and IDOR
Design deterministic negative-path tests for API object authorization, tenant isolation, revoked roles, caches, exports and background jobs.
Read the analysis2026-11-06 / ORIGINAL RESEARCH
Cloudflare Worker redirect loop: an annotated production incident
First-party analysis of a Cloudflare Worker static-asset redirect loop, its narrow fix, canonical route checks and release regression evidence.
Read the analysis2026-11-05 / ORIGINAL RESEARCH
App Attest: the server-side verification boundary
How to bind Apple App Attest keys and assertions to an app, a request and a real server-side authorization decision.
Read the analysis2026-11-05 / ORIGINAL RESEARCH
Play Integrity: bind verdicts to backend actions
A practical Android integrity design covering request hashes, server verification, risk tiers and attacker-controlled client signals.
Read the analysis2026-11-05 / ORIGINAL RESEARCH
API authorization: enforce the object boundary
Threat-model object-level authorization across REST endpoints, multi-tenant queries, async jobs and privileged workflows.
Read the analysisBUILD NOTES / CHANGE RECORD
What changed in the engineering practice.
2026-03-29 / Security
Mobile Security Review Offering Expanded
Expanded review coverage for iOS and Android account workflows, including stronger runtime assumptions and backend enforcement checks.
Read the work log2026-03-22 / Research
iOS Hardening Research Notes Published
Published field notes on failure patterns in iOS auth and session behavior under production rollout pressure.
Read the work log2026-03-17 / Backend
Backend API Abuse Review Package Added
Added a focused abuse-resistance review path for object-level authorization, privileged actions, and workflow misuse across production APIs.
Read the work log