Otukan protects both runtimes inside a React Native app: the JavaScript layer, shipped as minified JavaScript or Hermes bytecode, and the native layer of modules, SDKs and platform code on Android and iOS. It hardens the bundle where most of your business logic lives, checks its integrity when it loads, and detects hooking of the JavaScript engine and your native modules while the app runs. Otukan also works with your over-the-air update process, so legitimately updated bundles are protected and accepted while modified ones are flagged. Android and iOS builds are protected and validated separately, and your policy can respond differently on each.
Runtime coverage
JavaScript bundles and engines
Metro packages your JavaScript into a single bundle at build time. What ships depends on the engine, and Otukan protects both:
| Engine | What ships | How Otukan protects it |
|---|---|---|
| Hermes (the default engine since React Native 0.70) | Hermes bytecode, compiled at build time | Hardens the bytecode bundle and checks its integrity at load |
| JavaScriptCore | Minified JavaScript, parsed on the device | Hardens the bundle’s names and strings and checks its integrity at load |
On Android the bundle is normally index.android.bundle in the assets folder. On iOS it is normally main.jsbundle in the app bundle. Both are ordinary files inside the signed package, which is why Otukan protects the bundle itself, not only the native shell around it.
Native modules
Native modules are written in Kotlin or Java on Android, in Swift or Objective-C on iOS, or in C++ on both, and expose functions to JavaScript. With the new architecture, the default since React Native 0.76, JavaScript calls them directly through the JavaScript Interface (JSI) as Turbo Native Modules. With the old architecture, calls pass asynchronously over the bridge as serialised messages. Otukan covers both architectures.
| Component | How Otukan handles it |
|---|---|
| JavaScript or Hermes bundle | Hardened, and integrity-checked when it loads |
| JavaScript engine | Hermes and JavaScriptCore, each validated on physical devices |
| Architecture | Old and new architectures both covered |
| Your native modules | Hooking of their functions detected at runtime |
| Native build output | DEX and native libraries on Android, frameworks on iOS, protected per platform |
Dependencies
Bridge and interface behaviour
Every native module is an entry point. If an attacker modifies the bundle or hooks the JavaScript engine, they can try to call native functions with arguments your app would never send. Otukan detects the modified bundle and the hook, and applies your response before the sensitive flow continues. Sensitive operations, such as signing a payment request or reading a stored token, should still check their own inputs in native code, so each layer supports the other.
Third-party SDKs
npm packages often bring native code with them, linked by autolinking through Gradle and CocoaPods. Analytics, crash reporting, payments and identity SDKs run in the same process as your app, and some inspect or hook the app themselves. Otukan tunes its runtime checks so that these SDKs do not trip your policy. Share your SDK list up front, and the protected-build test plan covers each one on both platforms.
Expo apps follow the same path. Prebuild generates native Android and iOS projects, and Otukan protects those projects like any other React Native app.
Update lifecycle
Over-the-air updates
A hosted update service or a self-hosted update server can replace the JavaScript bundle and assets without a store release. Native code cannot change this way. Apple and Google both limit what an interpreted-code update may change, so check the current App Store Review Guidelines and Google Play policies for your use.
Otukan handles over-the-air updates in three ways:
- Update bundles go through the same protection step as the bundle in your store build.
- Integrity checks accept a legitimately updated bundle and flag a modified one.
- Otukan’s checks work alongside your update channel’s own bundle signing, which we recommend you enable, so the app rejects bundles you did not sign.
Testing
Otukan works with your team on a test plan covering the store build and at least one over-the-air update on physical Android and iOS devices:
- a clean install, a store update and an over-the-air update from the previous release
- sign-in and your most sensitive flow after each kind of update
- the same journeys with your third-party SDKs active
- start-up time and bundle size against the unprotected baseline
Measurement guidance is on mobile app protection performance. Platform detail is on Android app security and iOS app security. How protection fits a pipeline is covered on mobile app security integration.
Hybrid apps that run in a WebView are covered on Ionic and Cordova app security, from the web bundle to the native shell. For how React Native fits the wider protection model, return to mobile app security. If your app is already published, a free App Exposure Check reviews the public store release.