Demonic Binary — Engineering Research https://demonicbinary.com/research Original mobile, backend and application security engineering articles, examples and review methods. en-us App Attest: the server-side verification boundaryhttps://demonicbinary.com/research/app-attest-server-validation-and-failure-modeshttps://demonicbinary.com/research/app-attest-server-validation-and-failure-modesHow to bind Apple App Attest keys and assertions to an app, a request and a real server-side authorization decision.Thu, 05 Nov 2026 00:00:00 GMTJeffrey MonicaPlay Integrity: bind verdicts to backend actionshttps://demonicbinary.com/research/play-integrity-backend-verdict-policyhttps://demonicbinary.com/research/play-integrity-backend-verdict-policyA practical Android integrity design covering request hashes, server verification, risk tiers and attacker-controlled client signals.Thu, 05 Nov 2026 00:00:00 GMTJeffrey MonicaAPI authorization: enforce the object boundaryhttps://demonicbinary.com/research/api-authorization-enforce-every-object-boundaryhttps://demonicbinary.com/research/api-authorization-enforce-every-object-boundaryThreat-model object-level authorization across REST endpoints, multi-tenant queries, async jobs and privileged workflows.Thu, 05 Nov 2026 00:00:00 GMTJeffrey MonicaSession security is a server-side lifecycle problemhttps://demonicbinary.com/research/session-security-lifecycle-not-token-storagehttps://demonicbinary.com/research/session-security-lifecycle-not-token-storageAccess tokens, refresh rotation, revocation, concurrent clients and recovery paths viewed as one state machine.Thu, 05 Nov 2026 00:00:00 GMTJeffrey MonicaRelease integrity: a green build is not a trustworthy releasehttps://demonicbinary.com/research/release-integrity-beyond-green-buildshttps://demonicbinary.com/research/release-integrity-beyond-green-buildsConnect source review, artifact provenance, signing, deployment identity, rollout controls and rollback validation.Thu, 05 Nov 2026 00:00:00 GMTJeffrey MonicaOWASP MASVS test matrix for iOS and Android releaseshttps://demonicbinary.com/research/mobile-security-owasp-masvs-test-matrixhttps://demonicbinary.com/research/mobile-security-owasp-masvs-test-matrixMap OWASP MASVS control groups to iOS and Android storage, authentication, platform, privacy and backend release verification.Fri, 06 Nov 2026 00:00:00 GMTJeffrey MonicaAPI tenant-isolation regression tests for BOLA and IDORhttps://demonicbinary.com/research/api-tenant-isolation-regression-testshttps://demonicbinary.com/research/api-tenant-isolation-regression-testsDesign deterministic negative-path tests for API object authorization, tenant isolation, revoked roles, caches, exports and background jobs.Fri, 06 Nov 2026 00:00:00 GMTJeffrey MonicaCloudflare Worker redirect loop: an annotated production incidenthttps://demonicbinary.com/research/annotated-cloudflare-worker-incidenthttps://demonicbinary.com/research/annotated-cloudflare-worker-incidentFirst-party analysis of a Cloudflare Worker static-asset redirect loop, its narrow fix, canonical route checks and release regression evidence.Fri, 06 Nov 2026 00:00:00 GMTJeffrey Monica