Research
App Attest: the server-side verification boundary
How to bind Apple App Attest keys and assertions to an app, a request and a real server-side authorization decision.
Read or tryEngineering learning path
Mobile application security
A joint view of iOS, Android, device evidence, identity, abuse paths and reporting.
The boundary to understand
Where can a legitimate client or stolen session cross an application trust boundary?
- Model client-to-API, session and data boundaries
- Use integrity signals as one input, not permission
- Turn every finding into a reproducible negative test
Research and examples
Research
Play Integrity: bind verdicts to backend actions
A practical Android integrity design covering request hashes, server verification, risk tiers and attacker-controlled client signals.
Read or tryResearch
Session security is a server-side lifecycle problem
Access tokens, refresh rotation, revocation, concurrent clients and recovery paths viewed as one state machine.
Read or tryResearch
OWASP MASVS test matrix for iOS and Android releases
Map OWASP MASVS control groups to iOS and Android storage, authentication, platform, privacy and backend release verification.
Read or trySample report
Synthetic security report, code review, threat model and remediation plan
Four clearly fictional security review examples showing evidence, findings, scope boundaries and retest criteria.
Read or tryInteractive lab
API authorization: interactive tenant-boundary lab
Run synthetic client/object combinations against an intentionally vulnerable handler and a guarded policy.
Read or tryJeffrey Monica founded Demonic Binary. Explore his engineering background or the original company research behind these topic collections.