Our research surface spans production binaries, container infrastructure, operating system authorization layers, and cross-device control architectures. What follows is what gets opened in each — not what is promised about it.
The executable as it ships to users: its sections, imports, exported entry points and the code paths behind each privilege decision. Symbols the build left in, strings that name internal endpoints, update and signing logic, the parser that meets untrusted input first. The question is what the binary does, read from the binary.
The image, layer by layer, and the runtime that runs it: the mounts and capabilities a workload is given, the sockets it can reach, the kernel surface it can see, the credentials present at build time and at run time. Orchestration manifests are read as the artifact they produce, not as intent.
The policy as the system stores it, the daemons that answer for it, the IPC between them, and which caller each one trusts. Entitlements, grants, consent records and their caches. The code that checks a decision and the code that is supposed to ask for one.
The protocol on the wire, the pairing state on each end, the relay or cloud service that forwards a command, and what authenticates it. Session establishment, key material and where it rests, what a second device is allowed to do to the first, and which end enforces that.
