Knowledge base

In this collection

• KB collectioniOS app security guides

  Technical guides for iOS teams: Face ID and Touch ID done right, privacy manifest conflicts, re-signed and modded apps, and modified Frida builds on iOS.

• Technical guideHow to sign a protected Android app

  Sign a protected Android release with the right key, tool and order: jarsigner for bundles, apksigner for APKs, page alignment, then verify what users install.

• Technical guideHow to handle runtime threat signals

  Connect runtime threat signals to safe app behaviour: route them through one policy decision, respect the app lifecycle and enforce on the server.

• Technical guideHow to verify mobile app attestation

  Verify mobile app attestation on your backend: Play Integrity and App Attest checks, request binding, replay protection and outage handling.

• Technical guideMobile certificate pinning rotation guide

  Plan certificate pin rotation with overlapping keys, per-stack Android and iOS pin sets, stale-client tests and a recovery path that keeps TLS validation.

• Technical guideHow to test app shielding performance

  Measure app protection overhead with matched builds, physical devices and repeatable workloads. Record startup, size, memory, stability and the spread of runs.

• Technical guideHow to configure Android kiosk mode

  Configure Android kiosk mode with device-owner lock task, a persistent kiosk launcher, a tested allowlist and recovery tests for restarts and network outages.

• Technical guideHow to integrate device security signals

  Integrate device security signals: verify origin with Android key attestation, check boot state and freshness, and test legitimate updates and adverse states.

• Technical guideHow to protect Android iOS apps from keylogging malware

  Protect typed secrets from keylogging: Android accessibility malware checks, sensitive views, keyboard flags, in-app PIN pads and iOS secure text entry.

• Technical guideAndroid biometric attributes implementation guide

  Implement Android biometric checks with Class 3 keys, key attestation at registration, fresh server challenges, tested recovery and a minimal evidence record.

• Technical guideHow to detect unauthorized contacts access in mobile apps

  Find out which code in your app reads contacts: Android data access auditing, iOS App Privacy Report, pickers instead of broad access, and lab tests.

• Technical guideHow to detect unauthorized microphone access in mobile apps

  Detect unauthorised microphone use in your app with Android audit callbacks, recording configuration checks, privacy indicators and the App Privacy Report.

• Technical guideHow to detect modified Frida builds on Android and iOS

  Detect modified Frida builds on Android and iOS by checking what instrumentation does in the process, not its name: memory maps, threads, ports and hooks.

• Technical guideHow to detect modified Frida builds in iOS apps

  Detect modified Frida builds in iOS apps with dyld image checks, inline-hook tests, thread, port and exception-port artefacts, and server-side App Attest.

• Technical guideMake custom mobile SSO workflows work in mobile apps implementation guide

  Build custom mobile SSO on ASWebAuthenticationSession and Custom Tabs with verified App Links, PKCE and audience-checked tokens, then test renewal and logout.

• Technical guideHow to prevent conflicts with iOS privacy manifest in iOS apps

  Fix the Multiple commands produce PrivacyInfo.xcprivacy error, package SDK manifests in their own bundles and declare required-reason APIs before review.

• Technical guideHow to detect repackaging in Android apps

  Detect repackaged Android apps with signer, installer and Play Integrity checks, then test them against signed baselines and approved key rotations.

• Technical guideHow to build a secure iOS Android pwa with deep links

  Make PWA deep links safe on Android and iOS: WebAPK and Trusted Web Activity link capture, Safari behaviour, manifest scope, launch_handler and route checks.

• Technical guideHow to control content in pwa secure uploads secure downloads

  Control PWA file transfers on the server: validate uploads, serve files from a separate origin with safe headers, keep them out of caches and test logout.

• Technical guideHow to prevent mods hacks that require re signing iOS apps

  Stop re-signed iOS app mods from reaching your service: App Attest on the server, Team ID and provisioning checks in the app, and tested signing changes.

• Technical guideRuntime threat signals best practices implementation guide

  Design the runtime signal contract, bind client signals to Play Integrity or App Attest on the server, and keep telemetry lean and reviewable.

• Technical guideiOS biometric attributes implementation guide

  Implement Face ID and Touch ID on iOS with the right LAPolicy, a Secure Enclave key bound to the current biometric set and a server-signed challenge.