Quickstart by platform

Every quickstart has the same four steps. Only the build command and the artifact path change.

1. Create the policy: npx moatgator init writes a valid moatgator.yml with every detection in monitor.
2. Scan a build locally, with no account: npx moatgator scan <artifact>.
3. Create the app in the console and an API key with builds:write and builds:read (or an OIDC rule for GitHub Actions).
4. Register builds from CI: npx moatgator protect <artifact> --app-version <version>. Pick your CI guide.

Platform	Artifact	Guide
Android (Kotlin, Java)	.aab or .apk	Android
iOS (Swift, Objective-C)	.ipa	iOS
React Native	.aab and .ipa	React Native
Expo	.aab and .ipa	Expo
Flutter	.aab and .ipa	Flutter

Preview engine

protect registers the build and uploads the package. No protected package is produced yet; the command says so, and --require-protected makes the job fail until the engine ships. See limits and guarantees.

Skip the manual setup

The Moatgator GitHub App detects your platform (including monorepos), opens one pull request with the moatgator.yml files and a ready workflow, and never changes your app code. It cannot write to .github/workflows, on purpose: the pull request tells you to git mv the workflow into place, which doubles as a review step.