AppDefender.dev platform

Native Security Bridge

The Client installs @appdefenderdev/sdk.react-native and calls a small API. Android and iOS cores own AppDefender, CodeDefender, KeysDefender, CryptoEngine, offline policy, and enforcement.

CLIENT APP (React Native)
        │
        ▼
@appdefenderdev/sdk.react-native   thin adapter
        │
        ▼
Native Security Bridge     initialize / launchSecurityCheck / getSecurityState /
                           protectAction / getDependencyState / getKey
        │
        ▼
AppDefender Native Security Core
        ├── Android (Kotlin + private C/C++ + CryptoEngine)
        └── iOS (Swift + private engine + CryptoEngine)

Read the Native Security Bridge contract

Launch Security Gate

APP LAUNCH
    │
    ▼
AppDefender.dev SDK
    │
    ├── AppDefender              root / jailbreak / emulator / debugger / hooking
    ├── CodeDefender             tamper / integrity / anti-Frida / anti-Xposed
    ├── KeysDefender              tokens / API keys / certificates / secrets
    ├── CryptoEngine            SHA-256 / SHA-3, AES-256-GCM, HKDF, Secure Random
    ├── OfflineThreatHandler    signed cached policy + local detection
    └── DependencyCallback      bridge to React Native
    │
    ▼
SECURITY DECISION
    ├── ALLOW    → Authentication → ApiDefender (ATS Lite|Full) → App Features
    ├── RESTRICT → Limited functionality only
    └── BLOCK    → Stop launch. Network and tokens cannot override.

Core modules

AppDefender.dev
    ├── AppDefender     runtime RASP — root, jailbreak, emulator, debugger, Frida, overlay
    ├── CodeDefender    source/binary — obfuscation, JS/Hermes, anti-RE, anti-tamper
    ├── KeysDefender     secrets — SDK keys, dynamic delivery, rotation, KMS/HSM
    └── CryptoEngine   SHA-256 / SHA-3, AES-256-GCM, HKDF — native only

KeysDefender and CryptoEngine

KeysDefender is mandatory for third-party SDK credentials. Super Admin encrypts the secret; the app receives a signed KP1 token; native code unwraps a short-lived copy only after ALLOW. AES keys never enter React Native. Crypto algorithms are a Super Admin policy — SHA-1 is legacy-only.

KeysDefender contract

Offline Threat Handling

Mandatory on every launch. When the device is offline the last securely provisioned policy plus local detection decide ALLOW, BLOCK, or RESTRICT.

Read the Offline Threat Handling contract

ApiDefender / ATS

After ALLOW, every protected route still requires login + access token + attestation. ATS Lite for routine reads. ATS Full for payments and beneficiary changes. TOKEN_IN_BODY is rejected. A clean token cannot override BLOCK.

Control plane and runtime plane

Detect → Assess → Advise → Notify → Remediate → Verify. Super Admin publishes from the Security Advisory Center. Each Client keeps a history of what was detected, when they were notified, and whether the app is protected.

APPDEFENDER.DEV
        │
┌───────┴────────┐
│                │
CONTROL PLANE    RUNTIME PLANE
│                │
Client / app /   Native Security SDK
SDK / policy     RASP · Anti-tamper
KeysDefender       Root / jailbreak
Advisory engine  Hook / debug detect
Threat intel     Offline launch gate
Notifications    Native Security Bridge
│                │
Email / dashboard  Android / iOS
Webhook / API      │
        └────→ Client app

Client advisory contract

Tenancy

Super Admin enables Sandbox and/or Production per Client. Client Admin sees only enabled environments. RLS + Go WithScope isolate tenants. Production policy is Maker–Checker.