App shielding is the set of protections built into a mobile app so that it resists analysis, modification and misuse on devices you do not control. It combines obfuscation, integrity checks and runtime detection, and it passes what it observes to your backend. Shielding matters most where a user flow crosses from the phone to your services: login, payment, onboarding, unlocking paid content. It raises the cost of attacking the app and improves the information your server acts on; it does not replace server-side authorisation, and every protection needs its own scope on Android and on iOS.
The flow and the trust boundary
Your backend can trust its own code. It cannot trust the app, because the app runs on hardware the attacker may own. Shielding works on the app side of that boundary, and each attack it addresses maps to a flow you care about:
- Credential and session theft. An attacker hooks the login screen or reads tokens from memory.
- Scripted API abuse. Endpoints and keys lifted from the package let a script imitate your app at scale.
- Repackaged copies. A modified build with injected code or removed checks circulates outside official stores.
- Logic bypass. A debugger flips the result of a local check, such as a balance, a licence or a feature flag.
Android and iOS expose these differently. Android packages contain bytecode that decompiles readily, and a re-signed APK can be installed outside Google Play. iOS apps are native code under enforced code signing, so attackers usually work on a jailbroken device or re-sign with their own certificate.
Who is responsible for what
| Layer | Responsibility | Examples |
|---|---|---|
| App (shielding) | Make code hard to read, notice tampering and a hostile runtime, report what it sees | Obfuscation, integrity checks, hooking and debugger detection |
| Operating system | Isolate apps, enforce signing, protect keys | App sandbox, Android Keystore, iOS Keychain and Secure Enclave |
| Backend | Make the final decision on every sensitive request | Signal verification, authorisation, rate limits, fraud rules |
Each layer covers a gap in the others. The operating system cannot tell whether your app’s own code was altered. Shielding cannot stop a request from a script that never ran your app. The backend sees both only if the app sends its signals along.
How to evaluate app shielding
Ask for evidence on your own builds, not a feature list:
- Platform scope. Each control stated separately for Android and iOS, and for Flutter or React Native where you use them.
- Static resistance. A decompiler comparison of protected and unprotected builds for the classes you care about.
- Tamper and runtime tests. A re-signed copy, a hooking session and a debugger attach, each with the signal your backend receives.
- User impact. Launch time, package size and key journeys measured on the devices your users have.
- False positives. A negative control on legitimate devices, including ones with developer or accessibility settings switched on.
- Operations. Readable crash reports, per-flow policy and a release process that leaves your signing keys with you.
How Otukan delivers shielding
Otukan builds one shielding profile per app, combining obfuscation, string and resource protection, integrity checks and runtime detection. The same profile carries checks written for Android and for iOS, protects Flutter and React Native framework code, and sends each signal with the requests you choose. You decide the response per flow, from observe to terminate. Otukan validates each protected build with you, including a negative control on legitimate devices, and it fits your existing build and release pipeline while your signing keys stay with you.
The product is covered on mobile app shielding. The runtime layer is covered on what is runtime application self-protection, and the static layer is covered on what is code obfuscation. For how the two overlap, see app shielding vs RASP. Related terms are defined in the mobile security glossary. Criteria for comparing protection options are set out in how to evaluate mobile app protection.