DEMONIC BINARY / LABS

Read the source.
Break the assumption.

Explore runnable code, browser simulations and research on API authorization, sessions, release reliability and threat analysis.

Explore experiments Public code

OPEN SOURCE / HANDS-ON LABS

Run the models. Read the code.

PUBLIC SOURCE / RUN LOCALLY

LAB 01

API authorization across tenants

An intentionally vulnerable and corrected Node.js API with SwiftUI and Kotlin development clients. Compare cross-tenant requests and the enforcement point.

Run local lab

BROWSER MODEL / SYNTHETIC

LAB 02

Session lifecycle and token replay

Drive session expiry, revocation and replay decisions through a deterministic model. No live accounts or network attack surface.

Run browser model

BROWSER MODEL / SYNTHETIC

LAB 03

Release gates and rollback

Observe what the release decision looks like when evidence is missing, a verification step fails or rollback is required.

Run browser model

BROWSER LAB / SYNTHETIC

LAB 04

Code review with negative tests

Compare unsafe and guarded object lookups, then test the resulting access-control decisions against fabricated records.

Review the code

SYNTHETIC RESEARCH

LAB 05

Threat analysis and false alarms

Analyze fabricated endpoint events and Android declarations, including missed detections and false positives.

Open threat lab

BEYOND THE LAB

Need a deeper security assessment?

We review mobile applications, APIs and backend workflows under a defined security assessment scope. Start with the attack surface and the access controls that matter.

Explore security assessments

API object authorization and tenant isolation

Session revocation, replay and token lifecycle

Release integrity and recovery paths

Threat analysis and incident investigation

Need a controlled review of your system?

A commercial review begins with written permission, a defined target and safe test boundaries—not with a public demo URL.

Discuss scope and authorization