Evaluate an Ionic or Cordova app as four layers, not one: the web bundle that holds most of your logic, the WebView that runs it, the bridge that lets JavaScript call native plugins, and the native shell that is signed and shipped to the stores. Each layer is exposed differently on Android and on iOS, and each needs its own control. Otukan protects all four for Android and iOS releases, whether your Ionic app runs on Cordova or on Capacitor. This page sets out what to check at each layer, how Otukan fits your release process, and how to validate a protected build before it ships.
Component scope
Web bundle
Your compiled TypeScript or JavaScript, HTML templates and CSS are packaged as ordinary files: under www for Cordova and public for Capacitor, stored in the APK or app bundle on Android and inside the app bundle on iOS. Anyone who downloads the app can extract them. Otukan encrypts and integrity-checks this bundle, so business rules, endpoints and feature flags stop being plain text, and a modified file is detected.
WebView
Android apps render in the Android System WebView, which updates through the store independently of your app. iOS apps render in WKWebView, which updates with the operating system. Both allow remote inspection when it is enabled. Otukan flags inspection and native debuggers in release builds and applies your response.
Plugin bridge
Cordova plugins and Capacitor plugins expose native functions, such as biometrics, secure storage, file access or payments, to JavaScript. That makes the bridge the real security boundary: script injected into the page, or a hooked process, can call the same native functions your code calls. Otukan detects injected code and hooking frameworks around the bridge, and protects the native plugin code you own.
Native shell and embedded SDKs
The shell is a small Android or iOS project plus the plugins and SDKs you add. Otukan’s integrity checks cover it, detect repackaged copies, and tune runtime checks so that third-party SDKs which inspect the process do not trip your policy.
| Layer | What a reviewer can see in an unprotected release | What Otukan adds |
|---|---|---|
| Web bundle | Readable scripts, templates, endpoints | Encryption and integrity checks |
| WebView | Remote inspection when enabled | Inspection and debugger detection |
| Plugin bridge | Native functions callable from any script | Injection and hooking detection |
| Native shell | Re-signable package | Integrity checks and repackaging detection |
Release fit
Compiler and runtime
Your web framework and bundler produce the web output; Cordova or Capacitor then builds the native projects. Otukan protection fits into that same pipeline, and your Android upload key and Apple signing identities stay with your team. The native runtime, plugin list and web framework are the three facts we confirm first.
Update mechanisms
Some teams publish web content updates outside store releases. That changes the web bundle on the device without a new binary, so integrity checks must recognise updates you publish and reject anything else. Otukan plans coverage around your update path. Store rules also limit what such updates may change, which is a product decision your team keeps. If your web app ships to the stores in a native wrapper instead, see progressive web app protection.
For the wider integration model, see mobile app security integration.
Validation
Behaviour and third-party dependencies
Run install, update, sign-in and your most sensitive plugin call on physical Android and iOS devices, in both a baseline build and a protected build from the same commit. Include every third-party plugin that touches the network, storage or authentication. Repeat the same journey on a rooted Android device and a jailbroken iPhone in an authorised lab and record the signal your backend receives.
Symbols and start-up
Keep source maps out of production packages and store them with your build records. Confirm that native crash reports from protected builds still symbolicate on both platforms. Measure cold start and first render, because a hybrid app does work in the native shell and the WebView before anything appears. Hybrid measurement methods are covered on mobile app protection performance.
For the full protection model, return to mobile app security. If your hybrid app is live, a free App Exposure Check shows what its public build already reveals.