AppDefender.dev console is open for Client onboardinghello@appdefender.dev
Request access

Newsroom

2 September 2026 · CryptoEngine · KeysDefender

CryptoEngine: SHA-256 and AES-256-GCM. SHA-1 is legacy only.

Client-configurable cryptography with an anti-downgrade rule. AES keys never cross the React Native bridge.

Cryptography on AppDefender.dev is a Super Admin policy, not a hardcoded slogan in the SDK. The baseline for new work is SHA-256 or SHA-3, AES-256-GCM, HKDF-SHA-256, and 256-bit keys in platform secure storage.

SHA-1, AES-CBC, and AES-128 are rejected unless Super Admin sets an explicit legacy-migration flag. That flag is an exception, not a default. Devices that cannot accept the signed policy fail closed.

KeysDefender unwraps Client SDK secrets into Android Keystore or iOS Keychain only after AppDefender ALLOW. AppDefender.getKey tells React Native whether a named key was released. It never returns the AES material or the Client secret.

Operators configure this on the Client record. Devices fetch a signed POL1 package. Docs live under CryptoEngine and KeysDefender.

← All notes