Life / Adversarial analysis / Testing / Defense

Security research

Mobile and backend security exercises that trace attacker control, trust boundaries, failed checks and reproducible fixes.

Try this / Practical field guide

Object-level API authorization test

Use only synthetic accounts and resources you own or are authorized to test.

Create two test tenants with separate users and object IDs.
Log in as B and request an object owned by A; verify ownership is enforced on the server.
Try writing server-controlled fields such as ownerId or role; validate an explicit allowlist.
Repeat each test with a direct API request, not only a browser UI.
Add negative cases to regression tests and log decision codes without secrets.

A space for the things I want to share

Inside this collection

Threat models

Map what an attacker controls and where server-side checks are required.

Mobile and API security

Investigate sessions, replay, device trust, permissions and input handling.

Evidence and fixes

Document a synthetic failing case, the repair and the regression test.

Hands-on resources & related guides

Threat model builder API replay and authorization testing Break It / Fix It lab

Stories / Notes / Work in progress

Notes & stories

The first note belongs here.

No personal security research stories have been published in this collection yet. This section automatically fills with my own approved posts, notes, recipes, or build logs as I add them.

Visit the Life notebook

Photography / Original media

Photos & visual notes

A spot for the first photograph

Original photos only, with descriptive captions

Stories behind the images

Details and context, not stock or invented travel photos

Photo entries appear automatically after original pictures and captions are approved and added to the Life notebook.

Engineering / Inspectable examples

Code samples

Small educational examples, not customer code or claims of deployed robotics, firmware, or backend systems. Open any sample for its checks, source references, and limitations.

TypeScript / Tested teaching helper

Separate identity from resource authorization

Code & checks

interface Decision { authenticated: boolean; authorized: boolean; integrityOk: boolean }

export function canMutateResource(input: Decision): boolean {
  return input.authenticated && input.authorized && input.integrityOk;
}

A client or attestation verdict cannot grant access to someone else's object.

TypeScript / Tested teaching helper

Allowlist safe authentication telemetry

Code & checks

export function authEvent(input: {
  operation: string; outcome: 'allowed' | 'denied';
  token?: string; password?: string;
}) {
  return {
    event: 'auth.decision',
    operation: input.operation,
    outcome: input.outcome
  };
}

Create a structured outcome without recording the input's token or password.

Already on the site / Related material

More to explore

API replay and authorizationFive practical security failure cases.Break It / Fix ItSynthetic backend flaws and patches.Security contractsInspect request checks and trust boundaries.