Writing

Engineering·November 9, 2026·3 min read

How I connected Swift and Kotlin clients to agent workflows, built Core ML and TensorFlow Lite integration boundaries, and kept authorization on the backend.

Engineering·November 7, 2026·2 min read

Triada challenges an app-centric mobile threat model in an important way. Google's Android security team described a malware family that moved from rooting attempts into compromised system images. The malicious cod

Engineering·November 6, 2026·2 min read

I sent 200 scheduled refresh attempts through one local token family. Only one issued a successor; multiple workers would need a different test.

Engineering·November 6, 2026·3 min read

I tried consuming one action-bound challenge 200 times. My single-process guard accepted one call and rejected 199; shared-store races remain untested.

Engineering·November 6, 2026·3 min read

What requestHash protects, what the server must verify, and why an integrity verdict is not a substitute for authorization.

Engineering·November 6, 2026·3 min read

Design privacy-conscious auth decision logs that help explain failures without recording the credentials that caused them.

Engineering·November 6, 2026·4 min read

A valid App Attest or Play Integrity result cannot authorize a user. I walk through the server decisions separately and test them with synthetic inputs.

Engineering·November 6, 2026·3 min read

Practical tests for broken object-level authorization in authenticated mobile and backend APIs.

Engineering·November 6, 2026·4 min read

Model sign-in, refresh rotation, expiry, step-up recovery, and revocation without creating a hidden authentication bypass.

Build Note·March 29, 2026·12 min read

A practical look at building and evaluating device trust signals under jailbreaks, instrumentation, replay, and tampered clients, with emphasis on server-side verification and failure-aware design.