Skip to content
Have a software idea? +1 (650) 397-1782
Demonic Binary
EN

DEMONIC BINARY / OFFENSIVE SECURITY & SOFTWARE ENGINEERING

Build to last. Test to break.

Engineering and authorized offensive security for apps, APIs, cloud and AI systems. We uncover real failures, implement practical fixes and verify the result.

Get StartedExplore Services

California-based. Serving clients worldwide. Remote, hybrid and on-site by agreement.

SECURITY IS AN ENGINEERING DISCIPLINE

Proof over promises.

We work across the same boundaries attackers exploit—then carry the evidence into changes your team can review.

How testing works ↗

  1. Scope the system

    Define the assets, authorization and failure conditions before testing.

  2. Challenge the boundary

    Reproduce exploitable behavior and trace the actual cause.

  3. Fix and verify

    Review corrective changes and retest the paths that matter.

BUILT FOR REAL SYSTEMS / TESTED AGAINST REAL THREATS

Engineering and security, connected.

We build mobile and backend systems, test adversarial paths, and investigate what fails in production. Explore the technical practices, deliverables, and implementation evidence behind each service.

Explore services

WHY DEMONIC BINARY / HOW WE WORK

Built. Challenged. Verified.

SECURITY ASSESSMENT + ENGINEERING REMEDIATION

Find the risk. Fix the cause. Verify the result.

Authorized testing, optional code-level fixes and evidence-backed retesting. Each stage is scoped and approved, with work products your team can inspect.

Explore Find, Fix & Verify →

WORK WE TAKE ON

What we do

Explore All Services

01 / WORK

Mobile & backend engineering

We build and maintain native applications, backend services and the contracts between them. The messy part usually lives at the boundary.

Explore Service

Swift, Kotlin and REST/JSON. Authentication, offline recovery, state ownership, API contracts and release pipelines.

Mobile and backend workflow notes

02 / WORK

Security testing & remediation

We follow privilege, identity and data across app, API and infrastructure boundaries, including what happens when a client is compromised.

Explore Service

Written scope, reproducible attack paths, ranked findings, corrective code and retesting.

API authorization review

03 / WORK

Production rescue

We trace failures across clients, services and deployments until there is enough evidence to change the right component.

Explore Service

Request correlation, runtime traces, dependency failures, rollback paths and regression tests.

A real routing failure we fixed

DEMONIC BINARY / ENGINEERING STORIES

Engineering work.
From problem to fix.

Production incidents, mobile/backend systems and engineering labs. Explore the architecture, debugging and implementation behind each project.

See all stories Discuss a project
PUBLISHED WORK / SCROLLING GALLERY
01Production engineeringRepairing a Cloudflare Worker canonical-URL redirect loop02ObservabilitySiteGuard Monitor: service-health and alerting demonstrator03Mobile & APIsMobile and backend workflows across multiple operational sites

ENGINEERING AT A GLANCE

Systems, code and
production problems.

Explore projects
Published engineering stories
03

Readable technical accounts

Production incident
01

Routing and release repair

Controlled demonstrator
01

Local monitoring implementation

Anonymized architecture story
01

Mobile and backend architecture

FROM THE ENGINEERING RECORD

Behind the fix.

Read the notes behind each investigation, implementation and engineering decision.

These stories show engineering work from our systems and technical projects. For client references, our team can discuss what's available to share.

Customer referencesShare a project story

First-party operational work 01 of 03

Repairing a Cloudflare Worker canonical-URL redirect loop

The edge Worker requested /index.html and /services.html while the asset layer redirected these requests to / and /services.

— Excerpt from the published engineering case study

A production site stopped serving pages because asset requests for .html files bounced back to their clean canonical paths.

Read full story More stories
ENGINEERING PROJECT / 01
EDGE ROUTING / PRODUCTION
Before/services → /services.html → /servicesRedirect cycle
After/services → ASSETS.fetch(request)HTTP 200 · unknown routes 404
Read project
Featured engineering story 1 of 3

YOUR SYSTEM COULD BE NEXT

Have a failure worth investigating?

Describe the symptom and the system involved. We'll discuss where to start.

Discuss a project See all stories
ServicesResearch & guidesProjects & referencesBecome a partner

DEMONIC BINARY / ENGINEERING LABS

Test the assumptions. Read the code.

Security failures hide at boundaries. Explore our API authorization lab, browser models and original technical research.

Browse all tools & research

FEATURED / OPEN-SOURCE LAB

API authorization across tenant boundaries

A deliberately vulnerable and corrected Node.js API with synthetic tenant data, plus native iOS and Android development clients. Compare authorization behavior in a controlled environment.

Run interactive lab Inspect public source

REQUEST / SYNTHETIC

Tenant A identity

↓

Tenant B object

Unsafe: object disclosed

Guarded: access denied

SESSION SECURITY / BROWSER MODEL

Token refresh and session expiry

A deterministic session model for token-family invalidation, replay attempts and tenant access.

Run browser model

RELEASE INTEGRITY / BROWSER MODEL

Release gates and rollback decisions

Exercise pre-release checks and distinguish test evidence from an approved deployment.

Run browser model

01 / EXPLORE

Technical research

Original failure analyses, test records and implementation notes.

Read research

02 / EXPLORE

Resource center

5 downloadable engineering checklists, plus labs and source code.

Explore resources

03 / EXPLORE

Security assessments

Review scoped assessment options, input requirements and deliverables.

Review assessments

Have a project in mind?

Tell us what you're building or which system needs attention. We'll discuss the scope and the next step.

Discuss a projectHow engagements work