Research
API authorization: enforce the object boundary
Threat-model object-level authorization across REST endpoints, multi-tenant queries, async jobs and privileged workflows.
Read or tryEngineering learning path
Backend APIs & authorization
Object permissions, tenant isolation, async execution, identity propagation and testable enforcement.
The boundary to understand
If a caller changes a resource identifier, where does the authorization invariant hold?
- Enforce object access near data reads and writes
- Test cross-tenant and same-tenant peer access
- Carry scope through queues, exports and caches
Research and examples
Research
Session security is a server-side lifecycle problem
Access tokens, refresh rotation, revocation, concurrent clients and recovery paths viewed as one state machine.
Read or tryResearch
API tenant-isolation regression tests for BOLA and IDOR
Design deterministic negative-path tests for API object authorization, tenant isolation, revoked roles, caches, exports and background jobs.
Read or tryCase study
Mobile and backend workflows across multiple operational sites
A founder-led engineering account of authenticated mobile/API workflows and offline recovery across multiple operating sites.
Read or trySample report
Synthetic security report, code review, threat model and remediation plan
Four clearly fictional security review examples showing evidence, findings, scope boundaries and retest criteria.
Read or tryInteractive lab
API authorization: interactive tenant-boundary lab
Run synthetic client/object combinations against an intentionally vulnerable handler and a guarded policy.
Read or tryPublic source
Open source: API authorization lab
Public original Node.js local API, tested SwiftUI and Kotlin development clients, reproducible build instructions and synthetic tests.
Read or tryJeffrey Monica founded Demonic Binary. Explore his engineering background or the original company research behind these topic collections.