Detect
Native AppDefender sensors run before the first Client screen. Android and iOS catalogs stay isolated — 44 and 23 rules.
App Security · AppDefender.dev
AppDefender
Runtime Application Self-Protection at launch and in session.
Native sensors on Android and iOS. Root, jailbreak, emulator, debugger, hooking, overlay, accessibility abuse, and screen capture. Offline Threat Handling is mandatory inside the Launch Security Gate — cached policy plus local detection when the network is down. A valid access token never overrides BLOCK.
Launch Security Gate
Pairs with Offline Threat Defender
Root & jailbreak
Emulator, debugger, hooking
BLOCK cannot be overridden by network or token
44 Android / 23 iOS rules
What it does
AppDefender on the launch path
AppDefender is the Launch Security Gate. It runs in the native core before the Client UI, before login, and before a collect or pay screen. React Native is the adapter. Kotlin and Swift sensors own the score.
Detect → Decide → Enforce is the only path. The device is scored against an isolated Sandbox or Production catalog. ALLOW continues to authentication. RESTRICT limits the session. BLOCK shows the security screen, closes the app, and writes a ThreatDesk report. Waiting for the cloud is not fail-open.
Offline Threat Handling uses a signed cached policy plus local detection when the radio is down. The same BLOCK rule holds on a rooted handset with a valid access token. Network path and session cookies do not reopen a blocked launch.
What it scores
Signals this module is built for
- Root and jailbreak at cold start
- Emulator, debugger, and instrumentation
- Hooking frames — Frida, Xposed, and injected overlays
- Accessibility takeover and screen capture
- Sideloaded or cloned install of the Client app
- Signed offline policy when the network is down
How it runs
Detect, decide, enforce
Decide
ThreatDesk policy returns ALLOW, RESTRICT, or BLOCK for that environment. Severity is operator policy, not hardcoded in the SDK.
Enforce
BLOCK stops launch, shows the Client app name only, and reports the threat. A token, OTP, or cookie cannot override it.
Operators
Who owns the control
Super Admin
Enables Sandbox, then Production. Owns default catalog actions. Grants four Client Admin seats.
Client Admin
Sees isolated reports for that Client only. Makers cannot approve their own Production change.
Other App Security modules
Read the product page, not a copy here
All modules