App launch
User opens the Client mobile app or web app.
Solutions · RASP
Runtime Application Self-Protection
RASP is security that runs inside the Client app at launch and in session. AppDefender.dev uses it to Detect → Decide → Enforce before users reach protected UI. A valid access token never overrides BLOCK.
Definition
What RASP means on this website
Runtime Application Self-Protection (RASP) is a control that sits in the application runtime — not only in a network firewall, WAF, or MDM profile. The app itself scores the device, the binary, and the session, then allows, restricts, or blocks before protected screens or payment APIs run.
On AppDefender.dev that control is the Launch Security Gate on mobile and the session gate on web. Native AppDefender, CodeDefender, KeysDefender, and CryptoEngine run on Android, iOS, and React Native. The Web SDK runs the same Detect → Decide → Enforce order in the browser.
How the gate runs
Detect, decide, enforce
Launch Security Gate
Native AppDefender + CodeDefender + KeysDefender + Offline Threat Defender + Native Security Bridge. A signed cached policy still decides when the network is down.
Security decision
ALLOW, BLOCK, or RESTRICT. Network and tokens never override BLOCK.
ALLOW
Authentication, then ApiDefender (ATS Lite or Full). MFADefender and BindDefender sit beside the token.
BLOCK
Stop launch. Security screen. Token is irrelevant.
From Solutions
Mobile Apps and Web Apps share one RASP story
Mobile Apps
Launch Security Gate before the Client UI
Android, iOS, and React Native. The gate decides at launch. A valid access token never overrides BLOCK.
Web Apps
Session gate before protected pages
One Web SDK drop-in. Public App ID. The session gate decides before the page. A valid cookie never overrides BLOCK.
Mobile: the user opens the Client app. Native sensors run before Client UI. Offline Threat Handling uses a signed cached policy when the radio is down. Waiting for the cloud is not fail-open.
Web: one Web SDK drop-in and a public App ID. Runtime signals — automation, iframe, domain mismatch, DevTools as a risk event — feed the same decision. A session cookie cannot override BLOCK. DevTools detection is not a claim that the Network tab is hidden.
Modules
Where RASP lives in the product
AppDefender
Runtime Application Self-Protection at launch and in session.
CodeDefender
Obfuscation, anti-tampering, and anti-analysis for source and binary.
KeysDefender
Dynamic delivery of SDK keys, API secrets, and license material.
ApiDefender
Access-token validation, SSL pinning, ATS Lite and Full.
Runtime Application Self Protection
Detect, decide, and enforce on the device and in the cloud.
User Identity & Secrets
Keys, tokens, and certificates that RASP can still override.
Cyber Lab Services
Assessments for BFSI and UPI Client apps.
ATS & ATS Lite
Cloud attestation when the network path is required.
Code Hardening
Integrity and anti-hooking before and after ship.
Fraud and API Risk
Pinning, binding, and Maker–Checker production policy.
What RASP is not
- Not a phone-wide agent for every app on the handset.
- Not a generic WAF or CDN bot pack sold as RASP.
- Not a replacement for the Client’s own login server.
- Not a promise that Inspect → Network will hide working JSON from the browser user.