Treat a published mobile security index as a list of questions, then answer each one against your own compiled app. Surveys describe what organisations report across an industry; they cannot tell you whether your release exposes secrets, readable logic or native symbols. Otukan closes that gap for Android and iOS apps built natively or with Flutter or React Native. It baselines what your current binary reveals, applies code and binary protection to the layers that need it inside your existing pipeline, and compares analysis results and release impact before you ship. This page quotes no figures from any report; the numbers that decide come from your build.
Code scope
Industry reports speak about apps in general. An attacker works on one binary, and what they can read depends on the language each part was written in.
| Layer | Where it lives | What it leaks without protection | Otukan’s treatment |
|---|---|---|---|
| Kotlin or Java | DEX bytecode in the Android package | Near-source logic and descriptive names | Renaming, string protection, control-flow transforms |
| Swift and Objective-C | Mach-O executable in the iOS bundle | Class and selector names, Swift type metadata | Renaming where the runtime allows, symbol and string protection |
| C and C++ | Native libraries per architecture | Exported symbols and algorithm structure | Symbol stripping and native transforms |
| Dart | Ahead-of-time compiled library in Flutter apps | Function names and embedded strings | Framework-level protection |
| JavaScript | Plain or Hermes bytecode bundle in React Native apps | Readable app logic and API paths | Bundle protection |
| Metadata and resources | Manifest, Info.plist, assets and configuration | Components, permissions, endpoints and keys | Resource protection and review of what must stay readable |
Android and iOS are assessed separately. The Android manifest and the iOS Info.plist expose different things, and Objective-C keeps method names for its runtime in a way DEX bytecode does not, so the scope of each release is written per platform.
Choosing which themes to test
Not every trend in a report applies to every app. A payments app cares most about exposed endpoints and altered copies that bypass checks; a media app cares about unlocked paid features; an app with proprietary scoring cares about readable logic. Pick the three or four themes that match what an attacker would gain from your app, then turn each into a question the baseline analysis can answer with evidence.
For iOS specifics, see iOS code obfuscation.
Compatibility
A protection result means nothing if the app stops working. Otukan tests the places where transforms most often clash with how apps behave at run time.
Reflection and serialisation
Code that looks up a class or field by name, and libraries that map JSON keys to fields, need those names intact. Otukan keeps them and protects the code around them.
Selectors and dynamic dispatch
On iOS, Objective-C selectors, key-value coding and classes referenced from storyboards are resolved by name. Otukan leaves those names in place so dispatch keeps working.
Plugins and bridges
Flutter platform channels and React Native native modules connect framework code to native code by name. Otukan records each bridge that must keep its name and protects what sits behind it.
Crash symbolication
Each protected release keeps its mapping and debug symbols in your private archive, R8 mapping files on Android and dSYM files on iOS, so stack traces from users’ devices translate back to your source.
Validation
Compare approved analysis results
Analyse the baseline and protected builds with the same public tools and the same questions: which strings appear in clear form, which names explain the logic, which native symbols remain. Your security owner signs off the comparison, including the reasons anything still visible has to stay.
Measure release impact
Set the protected build against its baseline for download and installed size, cold start and your most sensitive journey, on physical devices that match your users. Run install, update and sign-in as regression checks. The method is described on mobile app protection performance.
For the full set of obfuscation techniques, see mobile code obfuscation. If your app is already in a store, start with a free App Exposure Check of the public release. For every protection layer Otukan offers, return to mobile app security.