Research
API authorization: enforce the object boundary
Threat-model object-level authorization across REST endpoints, multi-tenant queries, async jobs and privileged workflows.
Open entryEngineering research
Security research and engineering insights.
Technical investigations by our founder, covering mobile trust, backend authorization, failure recovery, security and release integrity. Each article explains the decision boundary, how to verify the behavior and which external sources support it.
iOS, Swift & app integrity
Native iOS architecture, App Attest server validation, session lifecycles and responsible releases.
Android, Kotlin & Play Integrity
Android integrity verdict policy, authenticated API contracts and lifecycle-aware recovery.
Mobile application security
A joint view of iOS, Android, device evidence, identity, abuse paths and reporting.
Backend APIs & authorization
Object permissions, tenant isolation, async execution, identity propagation and testable enforcement.
Platform & release integrity
Build provenance, CI/CD authority, Cloudflare routing, operational visibility and rollback.
Search the engineering library
Search our research articles, implementation details, failure analyses and test records. The search runs on the published site index rather than sending your query to a third-party search provider.
21 matching entries · Full article bodies and project notes searched locally in your browser; no query is submitted to a server
Interactive lab
API authorization: interactive tenant-boundary lab
Run synthetic client/object combinations against an intentionally vulnerable handler and a guarded policy.
Open entryResearch
API tenant-isolation regression tests for BOLA and IDOR
Design deterministic negative-path tests for API object authorization, tenant isolation, revoked roles, caches, exports and background jobs.
Open entryResearch
App Attest: the server-side verification boundary
How to bind Apple App Attest keys and assertions to an app, a request and a real server-side authorization decision.
Open entryEngineering log
Auth and Session Review Methodology Refined
Refined auth and session review methodology to improve exploitability ranking and implementation clarity for engineering teams.
Open entryEngineering log
Backend API Abuse Review Package Added
Added a focused abuse-resistance review path for object-level authorization, privileged actions, and workflow misuse across production APIs.
Open entryResearch
Cloudflare Worker redirect loop: an annotated production incident
First-party analysis of a Cloudflare Worker static-asset redirect loop, its narrow fix, canonical route checks and release regression evidence.
Open entryEngineering log
Infrastructure Reliability Advisory Sprint Now Available
Launched a focused advisory sprint for release-critical reliability gaps spanning CI/CD controls, rollback readiness, and service boundary resilience.
Open entryEngineering log
iOS Hardening Research Notes Published
Published field notes on failure patterns in iOS auth and session behavior under production rollout pressure.
Open entryCase study
Mobile and backend workflows across multiple operational sites
A founder-led engineering account of authenticated mobile/API workflows and offline recovery across multiple operating sites.
Open entryEngineering log
Mobile Security Review Offering Expanded
Expanded review coverage for iOS and Android account workflows, including stronger runtime assumptions and backend enforcement checks.
Open entryEngineering log
New Platform Engineering Engagement Model
Introduced a cleaner engagement shape for backend, auth, and reliability work that starts with one constrained risky workflow.
Open entryPublic source
Open source: API authorization lab
Public original Node.js local API, tested SwiftUI and Kotlin development clients, reproducible build instructions and synthetic tests.
Open entryResearch
OWASP MASVS test matrix for iOS and Android releases
Map OWASP MASVS control groups to iOS and Android storage, authentication, platform, privacy and backend release verification.
Open entryResearch
Play Integrity: bind verdicts to backend actions
A practical Android integrity design covering request hashes, server verification, risk tiers and attacker-controlled client signals.
Open entryEngineering log
Release Integrity Review Service Updated
Release review now includes stronger artifact provenance checks, rollback safety controls, and deployment-path enforcement visibility.
Open entryResearch
Release integrity: a green build is not a trustworthy release
Connect source review, artifact provenance, signing, deployment identity, rollout controls and rollback validation.
Open entryCase study
Repairing a Cloudflare Worker canonical-URL redirect loop
A production site stopped serving pages because asset requests for .html files bounced back to their clean canonical paths.
Open entryResearch
Session security is a server-side lifecycle problem
Access tokens, refresh rotation, revocation, concurrent clients and recovery paths viewed as one state machine.
Open entryCase study
SiteGuard Monitor: service-health and alerting demonstrator
We implemented Python/SQLite probes, durable health observations and a status view, then exercised the alert states with synthetic failure sequences.
Open entrySample report
Synthetic security report, code review, threat model and remediation plan
Four clearly fictional security review examples showing evidence, findings, scope boundaries and retest criteria.
Open entryJeffrey Monica is the founder of Demonic Binary, with a focus on mobile, backend and platform security. All currently published research articles are written by Jeffrey Monica. Future contributions will retain individual author credit.
Browse technical research, hands-on labs and implementation notes.