MOBILE / DEVICE TRUST
App Attest: server validation and failure modes
What device signals establish—and where trust must still be enforced.
Read research ↗Research / Labs / Guides
Research worth looking under the hood.
Original engineering investigations, open-source labs and practical security guides. See the evidence, reproduce the behavior and understand the fix.
FEATURED / FIRST-PARTY ENGINEERING
A redirect loop at the edge. Investigated and repaired.
A real routing failure in our own Cloudflare Worker. Follow the symptom, HTTP response chain, corrected asset boundary and verification. No client result is implied.
Read the full investigationCLOUDFLARE WORKER / REQUEST TRACE
BEFORE / REDIRECT LOOP
/services → /services.html → /servicesAFTER / ASSET ROUTING
ASSETS.fetch(request) → HTTP 200Verified on Demonic Binary infrastructure · first-party evidence
FROM THE RESEARCH DESK
Read the work behind the findings.
All research ↗RELEASE SECURITY
Release integrity beyond green builds
Test results are evidence, not a substitute for deployment controls.
Read research ↗AI / TOOL BOUNDARIES
Reviewing AI agent trust boundaries
Trace delegated authority and failure paths across tools and APIs.
Read research ↗DOWNLOADABLE SOLUTION BRIEFS
Find the right engineering and security service.
Take a concise overview into your next product, security or procurement conversation.
SERVICE BRIEF / PDF
Penetration Testing & Red Teaming
Find the weaknesses that matter. Fix them where they start.
Download PDFExplore serviceSERVICE BRIEF / PDF
iOS & Android Development
Native mobile experiences built for real-world use.
Download PDFExplore serviceSERVICE BRIEF / PDF
Backend & Cloud Engineering
Secure systems that behave when the happy path ends.
Download PDFExplore serviceSERVICE BRIEF / PDF
AI Agent Development & Security
Put AI to work. Keep your systems in control.
Download PDFExplore serviceTHE LIBRARY
Find the implementation detail.
Browse by format. Every collection below links to material already published on this site.
LABS / SOURCE
Open-source tools and interactive labs
Reproduce tenant authorization checks in an original Node.js lab, or run browser models of session and release behavior.
TECHNICAL RESEARCH
Implementation notes and failure analysis
Read engineering investigations into mobile trust, backend authorization, incident recovery and release correctness.
GUIDES / WORKSHEETS
Downloadable technical checklists
Working documents for release hardening, token lifecycle design, API access control, telemetry and AI agent boundaries.
MEDIA / LISTENING
Screencasts and engineering listening
Browse available technical videos and a clearly attributed selection of third-party engineering podcasts.
NEWS / RELEASE NOTES
Newsroom and engineering announcements
Read dated first-party research and company updates in one searchable archive. Press coverage is listed only after verification.
ALL PUBLISHED MATERIAL
Search research, tools and engineering projects.
Search by subject, format and intended reader to find research, implementation notes, sample reports and downloadable guides.
Find a useful starting point.
41 of 41 resultsResearch / Mobile
App Attest: the server-side verification boundary
How to bind Apple App Attest keys and assertions to an app, a request and a real server-side authorization decision.
Technical article
Security teamsOpen
Research / Mobile
Play Integrity: bind verdicts to backend actions
A practical Android integrity design covering request hashes, server verification, risk tiers and attacker-controlled client signals.
Technical article
Security teamsOpen
Research / AI & automation
API authorization: enforce the object boundary
Threat-model object-level authorization across REST endpoints, multi-tenant queries, async jobs and privileged workflows.
Technical article
Security teamsOpen
Research / Mobile
Session security is a server-side lifecycle problem
Access tokens, refresh rotation, revocation, concurrent clients and recovery paths viewed as one state machine.
Technical article
Security teamsOpen
Research / Mobile
Release integrity: a green build is not a trustworthy release
Connect source review, artifact provenance, signing, deployment identity, rollout controls and rollback validation.
Technical article
Security teamsOpen
Research / Mobile
OWASP MASVS test matrix for iOS and Android releases
Map OWASP MASVS control groups to iOS and Android storage, authentication, platform, privacy and backend release verification.
Technical article
Security teamsOpen
Research / APIs & backend
API tenant-isolation regression tests for BOLA and IDOR
Design deterministic negative-path tests for API object authorization, tenant isolation, revoked roles, caches, exports and background jobs.
Technical article
Security teamsOpen
Research / Platform
Cloudflare Worker redirect loop: an annotated production incident
First-party analysis of a Cloudflare Worker static-asset redirect loop, its narrow fix, canonical route checks and release regression evidence.
Technical article
Security teamsOpen
Case study / Platform
Repairing a Cloudflare Worker canonical-URL redirect loop
A production site stopped serving pages because asset requests for .html files bounced back to their clean canonical paths.
Project write-up
Decision makersOpen
Case study / Platform
SiteGuard Monitor: service-health and alerting demonstrator
We implemented Python/SQLite probes, durable health observations and a status view, then exercised the alert states with synthetic failure sequences.
Project write-up
Decision makersOpen
Case study / Mobile
Mobile and backend workflows across multiple operational sites
A founder-led engineering account of authenticated mobile/API workflows and offline recovery across multiple operating sites.
Project write-up
Decision makersOpen
Engineering update / Mobile
Mobile Security Review Offering Expanded
Expanded review coverage for iOS and Android account workflows, including stronger runtime assumptions and backend enforcement checks.
Technical article
EngineersOpen
DOWNLOAD / WORKING DOCUMENTS
Take the checklist into the review.
Auth / Security / Backend
Token Lifecycle Review Guide
A review guide for access/refresh design across client and backend: storage, transport, rotation, replay risk, and enforcement points.
API / Authorization / Trust boundaries
API Authorization Review Notes
Notes for reviewing backend authorization boundaries, invariants, and abuse resistance without over-trusting the client.
AI security / Agents / Policy
AI Agent Boundary Review Checklist
A checklist for agent/tool boundaries: policy enforcement, data access, auditability, and misuse resistance for production automation.
Original checklists, provided as starting points for engineering review; no certification or security guarantee is implied.
FROM RESEARCH TO REMEDIATION
Found something similar in your own system?
Bring the failing request, the affected trust boundary and what you've already ruled out. We'll discuss a defined investigation or assessment before requesting system access.