01
Overview
After the reset lab proved the security controls in isolation, this project attempted to carry them into a more realistic product surface: a modern web application for Android Enterprise device management, built with Next.js and TypeScript and backed by a database.
What this project is — and is not
02
Why I built it
The reset lab was deliberately self-contained: Python standard library, simulated state, no real devices. That made it a clean place to prove controls, but it left an obvious question unanswered — what happens when these controls meet a real product stack? This project was the attempt to find out: a full-stack web app with a real frontend, API layer, and persistence, aimed at the shape of an Android Enterprise management tool.
03
The approach
The project aimed to combine three layers:
- A Next.js / TypeScript / React front-end for device and request management.
- An API layer enforcing authentication and authorization at the boundary.
- A database for users, devices, requests, and audit records.
- Security concepts carried over from the lab: roles, approval, and audit logging.
04
Where it fell short
The original vision — a fully functional remote enterprise-management system — was not achieved. Real Android device control depends on platform enrollment, management APIs, and infrastructure that are far outside the scope of a portfolio build, and wiring a database-backed web app to a genuine device-management backend surfaced integration complexity that the simulation deliberately avoided.
Rather than overstate it, I treated the gap as the deliverable:
- It does not manage or wipe real devices — that path requires real Android Enterprise integration.
- Full-stack auth/authz across API boundaries is harder than in-process checks and needs more work to harden.
- Persistence, state management, and external integration each add failure modes a simulation never sees.
05
What it taught
Full-stack architecture
Building a real web app — UI, APIs, and a database together — meant designing data models and request boundaries that a self-contained simulation never required.
Android Enterprise concepts
Researching how device management actually works (enrollment, device states, management APIs) clarified the gap between simulating a reset in a file and orchestrating one through a platform.
Security at the edges
Auth, authorization, and input validation had to be enforced at API boundaries rather than inside one trusted program — a genuinely different and harder problem.
Integration is the hard part
The security controls that were straightforward in a controlled simulation became messy once real services, persistence, and external platform constraints were involved.
Honest scope
Learning to say clearly what a project does not do is itself an engineering skill — and one that matters in security, where overclaiming capability is a risk.
06
Where it fits in the progression
This project sits deliberately in the middle of a learning arc: Android Reset Lab proved the security controls in a tight, well-tested simulation; this tool tested whether I could carry them into a realistic full-stack stack and showed me where the real difficulty lives; Chokepoint then applied those lessons to a focused, complete, deployable security product. The incomplete build was not wasted — it is the reason the complete one is better scoped.