ZombieMutex / Engineering notebook
Mobile platforms, backend infrastructure, security engineering, reverse engineering and agent systems. I document what I build, the failures I reproduce and the decisions behind the fixes. Some work comes from enterprise environments; the public implementations here have their own source, tests and clearly stated limits.
Selected implementations / Tested locally
Rust · Binary security
I wrote an offline ELF64 inspector to audit executable stacks, PIE evidence, RELRO and writable/executable mappings without running the binary.
Untrusted binary → checked parser → hardening findings
6 Rust tests · 10,000 mutation cases
Go · API security
I reproduced cross-tenant authorization failures and concurrent duplicate writes, then checked the fixed implementation against the same attacks.
HTTP request → tenant policy → atomic mutation
24 concurrent writes: 120 vulnerable vs 5 fixed
TypeScript / Go · Agent systems
I implemented a browser policy evaluator for tool delegation, tenant scope, egress and replay, alongside a separate Go container-runner reference.
Model proposal → policy decision → bounded execution
7 policy scenarios · Go race tests
These are independent reference implementations and local tests, not customer penetration-test results or production sandbox certification. Source and limitations are linked from each project.
Mobile, backend, authentication and production failure investigations. I discuss decisions and boundaries without exposing private code or customer data.
Engineering background →Tools and integrations I built and tested, with source, fixtures, reproduction steps and specific limitations.
Code and test evidence →Source-backed analysis of authorization boundaries, incident failures and defensive implementation decisions.
Read security work →On the workbench
Mobile and backend engineering: iOS/Android authentication, API integration, authorization boundaries, encrypted storage, and practical security reviews. The fun part is finding what breaks before somebody else does.
Microcontrollers, Raspberry Pi, GPIO, sensors, firmware state machines, and the messy boundary between physical inputs and software. Yes, debounce is still a thing.
Side projects in SwiftUI, Jetpack Compose, APIs, and interface experiments—building little things, testing the edge cases, and occasionally shipping a wonderfully unnecessary feature.
A local challenge guard that binds principal, action and expiry to one consume decision.
Tenant-scoped operation keys, matching request fingerprints and a shared effect callback.
Single-use refresh credentials with token-family generation, revocation and expiry.
I scheduled 100 calls against one in-process idempotency key. The side-effect callback ran once; a real crash or a second worker is still untested.
I sent 200 scheduled refresh attempts through one local token family. Only one issued a successor; multiple workers would need a different test.
A valid App Attest or Play Integrity result cannot authorize a user. I walk through the server decisions separately and test them with synthetic inputs.
Nov 9, 2026 · 6 entries
