Runtime protection (SDK)

The CLI and Scan check your app at build time. The SDK is the part that runs inside your app, on the device, and watches for attacks while real people use it: root or jailbreak, emulators, debuggers, hooking frameworks like Frida, and tampered or re-signed builds.

The SDK never kills your app on its own. It detects, tells you (a listener callback), and reports the event to the console. You decide what to do — block a payment, step up authentication, or just record it — because a false positive that crashes the app is worse than the attack.

What it protects against

Threat	Android	iOS
Root / jailbreak	✓	✓
Emulator / simulator	✓	✓
Debugger attached	✓	✓
Hooking / instrumentation (Frida, Xposed, Substrate)	✓	✓
Tampering (re-signed or cloned build)	✓	✓
Memory-dump / ptrace hardening	✓	✓
Certificate pinning	✓	✓

Each finding carries a confidence from 0 to 1 and the signals that triggered it. One strong signal — or several weak ones — becomes "compromised"; a single weak signal stays "suspicious".

How it fits together

1. The SDK runs its checks at startup and on a timer (threats like Frida attach after launch).
2. Findings go to your ThreatListener and are sent to POST /v1/ingest/events with an API key.
3. The console shows them under Threats and in each app, and they feed the security score.

Pick your platform:

• Android quickstart — Kotlin, Gradle, native checks and string obfuscation.
• iOS quickstart — Swift Package, native anti-debug and anti-hook.