How this site is written

Sources, examples, and corrections.

I write about software I built and investigated, as well as public security incidents and personal interests. A measured result, a synthetic test, a public-source investigation and an enterprise implementation are different kinds of evidence. I keep that distinction visible.

Engineering reference articles

The engineering decisions and investigations here are my own work. I cite the standards, platform documentation and incident reports that support external claims. Where I used AI assistance to prepare a particular article or code example, I disclose it. I review what I publish; generated text is not test evidence, and invented inputs are not real customer data.

Projects and evidence

I wrote the enterprise case studies from systems I built or worked on. I simplify private architectures and omit customer names, unpublished source and confidential metrics. Local research projects have their own test boundaries. I label forks and public repositories accurately.

Reference implementations

Independent reference implementations and captured test fixtures document replay, authorization, concurrency and protocol boundaries. A local test does not establish production App Attest verification or a real-world security assessment.

Updating and correcting content

APIs change and I can miss things. When I make a meaningful correction, I'll update the text rather than pretending it's a brand-new article. If you find a mistake, send the URL and a short explanation through thecontact page.