Research /
API tenant-isolation regression tests for BOLA and IDOR
Design deterministic negative-path tests for API object authorization, tenant isolation, revoked roles, caches, exports and background jobs.
Read updateNewsroom / Dispatches
From the engineering desk.
Research, release notes and technical announcements, with the evidence behind each one. Press coverage appears only after it has been verified.
Published work, not borrowed headlines
Latest from Demonic Binary
Dates reflect the original publication record. Articles are Demonic Binary's own work; third-party press coverage is kept separate.
Research /
Cloudflare Worker redirect loop: an annotated production incident
First-party analysis of a Cloudflare Worker static-asset redirect loop, its narrow fix, canonical route checks and release regression evidence.
Read updateResearch /
OWASP MASVS test matrix for iOS and Android releases
Map OWASP MASVS control groups to iOS and Android storage, authentication, platform, privacy and backend release verification.
Read updateResearch /
API authorization: enforce the object boundary
Threat-model object-level authorization across REST endpoints, multi-tenant queries, async jobs and privileged workflows.
Read updateResearch /
App Attest: the server-side verification boundary
How to bind Apple App Attest keys and assertions to an app, a request and a real server-side authorization decision.
Read updateResearch /
Play Integrity: bind verdicts to backend actions
A practical Android integrity design covering request hashes, server verification, risk tiers and attacker-controlled client signals.
Read updateShowing 6 of 15 published items.
Press and research inquiries
Request a technical comment, ask about an article or verify a published claim.