Android quickstart

1. Create the policy

From the repository root (or your app module's parent):

npx moatgator init --package com.acme.pay

If your applicationId is in app/build.gradle(.kts), init detects it and you can drop --package. The generated file starts in monitor mode:

moatgator.yml

version: 1
extends: moatgator:recommended
app:
  android:
    package: com.acme.pay
runtime:
  root: monitor
  emulator: monitor
  debugger: monitor
  hooking: monitor
  tamper: monitor
  overlay: monitor
  a11y: monitor
  capture: monitor
  remote_access: monitor

Check it any time: npx moatgator validate prints the line and column of every problem.

2. Build and scan

./gradlew bundleRelease
npx moatgator scan app/build/outputs/bundle/release/app-release.aab --min-grade C

scan needs no login. It exits with code 4 if the grade is worse than --min-grade.

3. Register the build

export MOATGATOR_API_KEY=mg_live_...   # scopes: builds:write, builds:read
npx moatgator protect app/build/outputs/bundle/release/app-release.aab --app-version 3.4.1

In CI, use OIDC (GitHub Actions) or store the key as a masked CI variable. Never commit it.

Notes

• AAB or APK: both are accepted; the AAB is what you upload to Google Play.
• Signing stays yours. Moatgator never asks for your keystore.
• Multiple modules: point --app-version and the artifact at the app module (:app), not at libraries.
• Next: pick a CI guide, then tighten detections one at a time (monitor → warn → block), reading events between steps. See detections.