Field notes / Mobile security & backend APIs
I wrote these two security reviews around the controls that matter in mobile and backend systems: request binding, authentication, per-object authorization, concurrency and recovery. They include my threat-boundary diagrams and tested synthetic examples; I keep third-party assessment claims and customer data out of them.
Mobile device integrity / iOS & Android
Both APIs help evaluate whether a mobile request comes from an expected app or environment. Neither proves that a signed-in user can access a particular resource. The backend still owns that decision.
Read the analysisAPI security / authorization / reliability
A token can be valid while the operation is still unsafe. Test object access, editable fields, one-time evidence, and concurrent writes separately—and verify the server rejects each broken assumption.
Read the analysisA plain Markdown checklist for authorized, reproducible mobile API reviews. Includes request-binding, authorization, replay, concurrency, and logging checks. No accounts or data collection required.
Download the security review checklist