iOS & Swift
Notes on Swift, Secure Enclave, App Attest, Keychain, and the boundaries between iOS client claims and server decisions.
iosswiftapp attestkeychain
Explore topic Explore the notebook
Browse by engineering topic
Curated entry points to code, interactive explanations, technical articles and related projects. Each topic links to the material that exists; there are no empty keyword landing pages.
Android & Kotlin
Android engineering notes on Play Integrity request binding, Kotlin coroutines, Credential Manager and authentication recovery.
androidkotlinplay integritycoroutines
Explore topic Backend & APIs
Practical backend engineering references: idempotency, HTTP timeouts, authorization boundaries, observability and recovery.
backendapitimeoutretry
Explore topic Mobile Security
Jeffrey Monica's mobile security engineering guide to iOS App Attest, Android Play Integrity, backend authorization, replay resistance and negative-test cases.
securityauthenticationreplaydevice trust
Explore topic Security field guides
Compare mobile integrity APIs and follow practical request-level test plans, with links to the underlying references and synthetic labs.
App Attest vs Play Integrity: what a backend can verifyBoth APIs help evaluate whether a mobile request comes from an expected app or environment. Neither proves that a signed-in user can access a particular resource. The backend still owns that decision.Read the guide API replay and authorization testing: five failure casesA token can be valid while the operation is still unsafe. Test object access, editable fields, one-time evidence, and concurrent writes separately—and verify the server rejects each broken assumption.Read the guide