ENGINEERING / PUBLIC CODE / RESEARCH
Original security exercises, technical research and production investigations. Each card tells you whether you can run code, try a browser model or read the underlying analysis.
All demonstrations use authorized or synthetic environments. A publication is not a guarantee of production readiness, certification or assessment coverage.
WEB & APPLICATION SECURITY
Object authorization, session lifecycles and the difference between a valid identity and a permitted operation.
Public code
A deliberately vulnerable and corrected Node.js API with synthetic tenants and buildable SwiftUI and Kotlin clients. Compare cross-tenant object reads and server-side policy enforcement.
Evidence: Public repository, local automated tests and mobile development builds. Not a production scanner.
Interactive lab
Compare unsafe and guarded object lookup handlers, then exercise five deterministic authorization cases against synthetic records.
Evidence: Browser exercise with test fixtures; no third-party endpoints.
Browser simulation
Explore refresh replay, expiry, revocation and tenant access decisions without relying on client-controlled session state.
Evidence: Deterministic browser model, not a live identity provider.
MOBILE & DEVICE SECURITY
iOS and Android security investigations focused on attestations, integrity verdicts, request binding and negative tests.
Research
Server challenge binding, app identity validation, assertion counters and the authorization decisions an iOS attestation cannot make.
Evidence: Published technical analysis; not a deployable App Attest verification service.
Research
Android request hashes, backend verdict evaluation, stale tokens, replay windows and risk-based decisions tied to real actions.
Evidence: Technical research on device integrity and backend enforcement.
Research
A test-oriented view of mobile application security controls and how to turn trust-boundary assumptions into verification cases.
Evidence: Research and test methodology, not an independent mobile app certification.
AI AGENTS & TOOL AUTHORIZATION
Policy enforcement, tool permissions and the failures that occur when instructions are mistaken for authorization.
Browser simulation
Try a deterministic tool-authorization gate and observe how policy changes the outcome of synthetic agent requests.
Evidence: Browser-only simulation; no external model or customer data.
Download
Review policy enforcement, data access, auditability and misuse resistance before a tool-enabled workflow reaches production.
Evidence: Published worksheet for engineering review, not an automated AI penetration test.
CLOUD, INFRASTRUCTURE & TELEMETRY
Reproducible infrastructure failures, service-health observations and evidence-driven incident handling.
Case study
A production redirect loop caused by Worker asset lookups. Includes the change, canonical routing behavior and verified response cases.
Evidence: Production incident report with the corrected routing behavior.
Internal prototype
Python/SQLite service checks, stored observations and health-state transitions exercised with synthetic failures.
Evidence: Local demonstrator; not a managed production monitoring service.
Download
A review checklist for correlating logs, traces and audit signals without collecting unnecessary secrets.
Evidence: Original published engineering guidance, not an incident-response platform.
FORENSICS & DEFENSIVE RESEARCH
Harmless malware-analysis exercises and reproducible findings that make false positives, false negatives and model limits visible.
Interactive lab
Inspect fabricated endpoint events and mobile declarations with visible detection decisions, missed cases and false alarms.
Evidence: Non-malicious synthetic fixtures, not evidence of a real malware incident.
Case study
Two disclosed synthetic investigations documenting detection limits, Android permission review and follow-up validation.
Evidence: Reproducible browser demonstrations with sample data.
ABOUT THE CATALOG
No. Each item has an evidence label. The catalog includes one public code project, browser-only models, an internal prototype, research and downloadable guides. A research article is not a scanner or a deployed security product.
The API Authorization Lab links directly to its public GitHub repository. Other entries link to their published examples and methodology. The remaining exercises link to their technical write-ups and working examples.
The published browser experiences use synthetic inputs. The public code lab is intended for an authorized local test environment. Do not assume a demo has been validated for production use or third-party scanning.
The browser labs use fabricated data. The Cloudflare incident is about Demonic Binary's own website. Anonymized professional experience and customer references have separate publication rules.
The linked public research and browser experiences are accessible without a subscription. Reuse and redistribution of source code are governed by the license in each repository. Security consulting is a separate service.
Demonic Binary publishes original engineering work by its founder. Individual pages identify evidence and authorship where verified. Project maintenance and support commitments are not implied by publication.
AUTHORIZED ENGINEERING WORK
Share the environment, the trust boundary and the decision you need validated. We'll define scope, authorization and deliverables before accessing any system.
