Currently, there are no commonly present issues solely for the Capacitor development platform. For more general issues or questions, visit FAQ page. You can also check out the Issues section of our GitHub repository, where you can report issues and view existing reports.

freeRASP for React Native is a bare React Native plugin. When installing freeRASP into a project that uses Expo SDK, there may be extra configuration needed.

To integrate freeRASP into the Expo projects, follow the instructions for React Native. After that, continue on this page.

We provide a plugin config that sets up the dependencies of freeRASP without the need to eject the Expo project. It is recommended to use the plugin config. However, manual setup is also possible.

Plugin config setup

Add the plugin config to your app.json and specify the minSdkVersion (use at least 23). Additionally, if you are using Expo 50, increase the version of R8 above 8.2 with the R8Version property .

Manual setup

1. Increase minSdkVersion

   This can be done in two ways:

   • update the minSdkVersion property directly in android/build.gradle, or

   • use expo-build-properties plugin, which updates the property in the prebuild phase. .

2. Add maven dependency

   1. open android/build.gradle (if you don't see the android folder, run npx expo prebuild -p android in terminal to create it)

   2. add the following dependency under allprojects > repositories:

   3. if not already configured, add also:

Currently, there are no commonly present issues solely for the Native iOS development platform. For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

The most frequent issues occurring during integration:

General

import {
  setThreatListeners,
  talsecStart,
  removeThreatListeners,
} from 'freerasp-react-native';

...

useEffect(() => {
  setThreatListeners(actions);
  talsecStart(config);

  return () => {
    removeThreatListeners();
  };
}, []);

Android Devices

iOS Devices

#ifndef TALSECRUNTIME_SWIFT_H
#define TALSECRUNTIME_SWIFT_H

For more general issues or questions, visit FAQ page. You can also check out the Issues section of our GitHub repository, where you can report issues and view existing reports.

The general flow of the integration can be decomposed into the following steps:

1. Conforming to the prerequisites, e.g. setting up Android minSdkVersion.

2. Adding the dependency.

3. Setting up the configuration for the application, e.g. package name or whether it is production or not (see #Dev vs. Release version).

4. Handling the detected threats (callbacks).

5. Starting the SDK.

6. Enabling the source code obfuscation.

7. Registering in Data Visualisation Portal to see the data from your apps and compare it to global statistics.

8. Become familiar with User Data Policies and License.

9. Looking at , to provide an additional layer of protection by detecting malware or suspicious applications.

10. Looking at Features and Pricing Plans if you are interested in more advanced solutions to protect your application and business.

11. Reading through Wiki and FAQ, if you are interested in more detailed information about internal workings.

Dev vs. Release version

The Dev version is intended for development purposes. It allows you to work on your app without interference from security features that could disrupt the process, e.g. if you would implement killing of the application on the debugger callback.

The Release version is meant for production and must always be used for your published app. It enables all security protections provided by freeRASP.

To configure this, set the isProd flag in freeRASP:

• Release: isProd = true

• Dev: isProd = false

⚠️Dev version disables some detections which won't be triggered during the development process:

• Emulator/Simulator

• Debugging

• Tampering/Repackaging

• Unofficial store/source

• Obfuscation issues

• Developer mode

• ADB Enabled

Choose the Appropriate Version to Continue Integration

Choose the relevant section based on your app development platform:

The most frequent issues occurring during integration:

General

Android Devices

dependencies {
    ...
    // Talsec dependency
    implementation 'com.aheaditec.talsec.security:TalsecSecurity-Community-Flutter:<version>'
}

-keepclasseswithmembernames,includedescriptorclasses class * {
native ;
}

android:extractNativeLibs="true"

<application
    android:label="freerasp_example"
    android:icon="@mipmap/ic_launcher"
    android:extractNativeLibs="true">

iOS Devices

For more general issues or questions, visit FAQ page. You can also check out the Issues section of our GitHub repository, where you can report issues and view existing reports.

freeRASP is a lightweight and easy-to-integrate mobile security library designed to detect potential threats during the application's runtime. It contains multiple security checks, each aimed to cover possible attack vectors to ensure a high level of application security.

What does freeRASP do?

freeRASP provides detection of potentially dangerous behaviour, including the following:

• Using rooted or jailbroken devices (e.g., su, Magisk, unc0ver, check1rain, Dopamine).

• Reverse engineering attempts.

• Running hooking frameworks (e.g., Frida, Xposed or Shadow).

• Tampering or repackaging the application.

• Installing the app through untrusted methods/unofficial stores.

• Running the app in various emulators.

• Detect fake clones and multiinstancing (Parallel Space)

• Screenshot and screen recording attempts.

Advantages

• Reactions to various attacks and detected security threats via an API (callback mechanism).

• Simple integration.

• VPN detection.

• ADB, Developer Mode, USB debugging detections.

• No significant effect on the app performance.

• Data visualization Talsec Portal with real-time security insights, global benchmarks, and detailed analytics

• Weekly security report via email indicating the security status of devices and app integrity.

• Fulfills OWASP MASVS-RESILIENCE requirements.

Limitations

• Limits of Fair Usage Policy (free up to 100k devices).

• Data collection from your app to Talsec DB.

• Security protections:

  • basic protection against root/jailbreak (including Magisk, Dopamine),

  • basic runtime reverse engineering controls,

  • basic runtime integrity controls.

• No overlay and accessibility services misuse protection.

Talsec Portal

Access real-time security insights, global benchmarks, and detailed analytics!

• 📊 Real-Time Threat Monitoring: Gain insights into threat counts, types, and occurrences over time.

• 📈 Global Benchmarking: Benchmark your app's security against global statistics.

• 📚 Stay informed: Read the latest articles and documentation on app security best practices.

Workflow scheme

Supported platforms

freeRASP is currently supported for:

• Android

• iOS

• Flutter

• React Native

• Cordova

• Capacitor

• Unity

• Unreal Engine

freeRASP is currently tested and compatible with:

• 🤖 Android smartphones, tablets, emulators, Android TVs

• 🍎 iPhones, iPads, simulators

Discover freeRASP

🖥️ Talsec Portal - Learn Your Security Posture, Detect Threats, and Benchmark Your App

Access real-time security insights, global benchmarks, and detailed analytics!

Talsec Portal is a centralized dashboard that visualizes the security data collected by freeRASP from your app, giving you real-time insights into threats, incidents, and benchmarks—so if you're using freeRASP, this is where your app's security intelligence lives.

• 📊 Real-Time Threat Monitoring: Gain insights into threat counts, types, and occurrences over time.

• 📈 Global Benchmarking: Benchmark your app's security against global statistics.

• 📚 Stay informed: Read the latest articles and documentation on app security best practices.

Watch the Demo

✨ Features

🛡️ Security incidents

Details about incidents:

• Tampered apps and clones

• Reverse Engineering - Debug

• Reverse Engineering - Hooks

• Root or Jailbreak

• Unofficial store

• Emulator/Simulator

📱 Device info

Details about devices:

• OS version

• Screen lock

• Biometrics

• Hardware-backed Keystore

🧾 Activity log

Real-time activity logs from the application, showing ongoing threats.

🔑 Access

🚀 Initial Steps

1. Visit the Talsec Portal.

2. Run through the onboarding wizard and explore demo data.

3. Discover insights using demo applications and global security statistics.

🔐 Accessing Your Account

1. Click on Login, then Sign Up.

2. Use the email address (watcherMail) associated with your TalsecConfig.

3. Create an Organization.

Now, you can view data for your applications. You can invite other users to your organization to see your data (see Organization Settings). The users can also add their applications to your organization to share their data.

Variables

TalsecConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

Classes

public class Talsec

Methods

public static func start(config: TalsecRuntime.TalsecConfig)

• The method used to start freeRASP's audit.

public static func blockScreenCapture(enable: Bool, window: UIWindow)

• The method blocks the screen capture in specific UIWindow.

public static func isScreenCaptureBlocked(in window: UIWindow) -> Bool

• The method returns whether the screen capture is blocked in specific UIWindow.

public static func storeExternalId(externalId: String)

• The method stores an externalId into the logs for data collection.

Protocols

public protocol SecurityThreatHandler

Methods

func threatDetected(_ securityThreat: TalsecRuntime.SecurityThreat)

• Notifier about detected threats.

public protocol TalsecRuntume.RaspExecutionState

Methods

func onAllChecksFinished()

• Notifier about finished threats

Enums

public enum SecurityThreat : String, Codable, CaseIterable, Equatable

Provides all types of threats detected by freeRASP. Read more about the meaning of the threats in the .

Cases

• signature

• jailbreak

• debugger

• runtimeManipulation

• passcode

• simulator

• missingSecureEnclave

• systemVPN

• deviceChange

• deviceID

• unofficialStore

• screenshot

• screenRecording

Variables

TalsecConfig

Specifies configuration for your app. See the table below for a detailed description of the attributes.

Classes

public class ThreatListener

Constructor

public ThreatListener(@NonNull ThreatDetected threatsCallback, @Nullable DeviceState deviceStateCallback, @Nullable RaspExecutionState raspExecutionCallback)

• Listener for the threats detected by freeRASP

Methods

public void registerListener(@NonNull Context context)

Registers your reactions to detected threats with freeRASP.

public void unregisterListener(@NonNull Context context)

Unregisters the reactions to detected threats.

public final class Talsec

Methods

public static void start(@NonNull Context context, @NonNull TalsecConfig config, @Nullable TalsecMode mode)

The method used to start freeRASP's functionality. TalsecMode is an optional parameter that can be used to force the execution of freeRASP in FOREGROUND / BACKGROUND thread (default value is TalsecMode.BACKGROUND).

public static void blockScreenCapture(@NonNull Activity activity, boolean enable)

The method used to block/unblock screen capture.

public static void isScreenCaptureBlocked()

The method used to know the state of screen capture blocking whether blocked or not.

Interfaces

public interface ThreatDetected

Sends callbacks to your app when a threat is detected. Read more about the meaning of the callbacks in the .

Methods:

• void onRootDetected()

• void onDebuggerDetected()

• void onEmulatorDetected()

• void onTamperDetected()

• void onUntrustedInstallationSourceDetected()

• void onHookDetected()

• void onDeviceBindingDetected()

• void onObfuscationIssuesDetected()

• void onScreenshotDetected()

• void onScreenRecordingDetected()

• void onMultiInstanceDetected()

• void onLocationSpoofingDetected()

• void onTimeSpoofingDetected()

• void onUnsecureWifiDetected()

• void onMalwareDetected(@NonNull List<SuspiciousAppInfo> suspiciousApps)

public interface DeviceState

Provides device state listener to get additional information about device state. Read more about the meaning of the device state listeners in the .

Methods:

• void onUnlockedDeviceDetected()

• void onHardwareBackedKeystoreNotAvailableDetected()

• void onDeveloperModeDetected()

• void onADBEnabledDetected()

• void onSystemVPNDetected()

public interface RaspExecutionState

A class which represents a set of callbacks that are used to notify the application when state of executing RASP checks changes.

Methods:

• void onAllChecksFinished()

If you want to learn about the differences between freeRASP and BusinessRASP+, you’re in the right place. On this page, we’ll explore the key features and benefits of each option, compare their functionalities, and highlight how the BusinessRASP+ subscription can offer enhanced capabilities and support compared to the freeRASP plan. By the end, you’ll have a clear understanding of which solution best meets your needs and how to make the most of it.

What are the advantages of the commercial Talsec SDK subscription plans compared to freeRASP?

freeRASP is a freemium product, which means there are . For using freeRASP, please refer to the .

and are premium products with a subscription model (which includes SW licenses, SLA, maintenance updates, and more) for SDKs. It is not SaaS, which means we don't introduce any dependency on third-party web services for your mobile solution.

Talsec doesn't collect any customer data within RASP+, while freeRASP SDK sends the diagnostical information to Talsec servers to provide clients with regular security reports and improve the product. You should consider adding Talsec to the list of Data Processors in case of freeRASP usage.

Top 10 Advantages of Talsec RASP+ Business Subscription Over freeRASP

Here are the top 10 benefits of choosing a Talsec RASP+ Business subscription, which includes an SDK license, SLA, and additional services, compared to the freeRASP option.

For any questions, please refer to our or schedule a call with us by choosing a time slot on .

Step 1: Convert to Base64

To convert the hash to Base64 form, use an online tool like :

After conversion, you'll receive a final Base64 string like this:

Step 2: Use resulting string in your Talsec configuration ✅

Your work here is done. Insert it into your Talsec configuration.

Example of a Talsec freeRASP configuration in Flutter with the resulting string:

Step 1: Use Your Release Keystore to Get the SHA-256 Hash

A common mistake is using the wrong signing key, which will cause the Talsec SDK to flag your app as a security risk. To avoid this, you must use the keystore that signs your app for public release.

Here’s the difference:

• Debug Keystore: Created automatically by Android Studio. DO NOT USE THIS ONE. It is insecure and only for development purposes.

• Release Keystore: The secure keystore you create and manage. USE THIS ONE. It's what permanently ties your app to you as the developer.

If you haven't created a release keystore yet, the will walk you through the process.

Step 2: Retrieve SHA-256 Hash

You can use tools like keytool or apksigner to retrieve certificate details, including the SHA-256 hash. Choose whichever is most convenient: get the hash from your signed release APK or directly from your release keystore:

This command will output the certificate details, including the SHA-256 hash, which will look something like this:

You'll need this value for the next step.

Step 3: Convert the SHA-256 Hash to Base64 Format

Convert the hash to Base64 format, as the SDK requires it in this format. Follow the steps in ➡️

This project is provided as freemium software, i.e. there is a that imposes some limitations on the free usage. The SDK software consists of open-source and binary parts, which is the property of Talsec. The open-source part is licensed under the MIT License - see the file on GitHub for details.

Time spoofing attack is when an attacker (or malicious app) manipulates the device's clock or its time source (e.g. network, GPS, or NTP) to cause system apps to behave incorrectly.

Time spoofing in mobile apps is often used to extend or reuse expired tokens, OTPs, or sessions, bypass trial periods and usage quotas, and skip waiting or cooldown times for time‑restricted features, giving attackers or unauthorised users continued access or unfair advantages.

Below are code snippets demonstrating debugger detection across various platforms:

Running an application inside an emulator/simulator allows an attacker to hook or trace program execution. For applications running inside an emulator, it is easy to inspect the system's state, reset it to a saved image, or monitor how the app operates. Keep in mind that not every emulator/simulator usage means an ongoing potential threat for the application.

Below are code snippets demonstrating emulator detection across various platforms:

// Android emulator check
override fun onEmulatorDetected() {
    TODO("Not yet implemented")
}

// iOS simulator detection
case simulator

// Flutter emulator and simulator detection
onSimulator: () => print("Simulator")

// Cordova emulator and simulator detection
simulator: () => {
    // Place your reaction here
}

// React Native emulator and simulator detection
simulator: () => {
    // Place your reaction here
}

// Capacitor emulator and simulator detection
simulator: () => {
    // Place your reaction here
}

What is Signing Certificate Hash?

All Android apps must be signed with a digital certificate before installation. The signing certificate SHA-256 hash in Base64 form - which we'll refer to as the hash for short, also known as a fingerprint -is the certificate's unique identifier, crucial for security and integrity. The Talsec SDK uses this hash for app tampering detection.

Choose Your Signing Method

The first step is to determine which app signing method you're using.

If you're using Google Play App Signing, a very common practice for Android App Bundles (AAB) distribution, your upload key and distribution key are distinct. So, be sure to use the app signing certificate key from the Google Play Console. Proceed with the Google Play App Signing Method.

If you're managing your own signing key (Manual App Signing), you'll need to generate the hash yourself from your keystore, proceed with the Manual App Signing Method.

Continue with the method that matches your signing process ➡️

The freeRASP SDK contains public API, so the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to interrupt freeRASP SDK operations or modify the custom code in threat callbacks. All internal freeRASP classes are already obfuscated, so it is simple to distinguish freeRASP sources from the rest of the application code during the static analysis. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also to make it partially randomized for each application so it cannot be automatically abused by generic hooking scripts.

Please follow the integration guide of your platform for more information about how to obfuscate the app.

Below are code snippets demonstrating missing obfuscation detection across various platforms:

// Android
override fun onObfuscationIssuesDetected() {
    TODO("Not yet implemented")
}

// Flutter
onObfuscationIssues: () => print("Obfuscation issues")

// Cordova
obfuscationIssues: () => {
    // Place your reaction here
},

// React Native
obfuscationIssues: () => {
    // Place your reaction here
},

// Capacitor
obfuscationIssues: () => {
    // Place your reaction here
},

Android developer mode allows deeper system access and debugging capabilities that can bypass app security measures. Developer mode can enable settings that facilitate the installation of uncertified applications and the execution of potentially harmful code, posing significant risks to data integrity and app functionality. FreeRASP detects whether the developer mode is enabled.

Warning: This vulnerability is particularly critical on Android 12 and 13 devices with Developer Mode enabled. A local attacker with ADB shell access can execute arbitrary code within the context of any non-system app, granting them full access to the app’s private data files, AccountManager-stored credentials, and other privileged resources. This bypasses the Application Sandbox’s intended protections, which are designed to isolate app data even from device owners.

Below are code snippets demonstrating developer mode detection across various platforms:

// Android Developer mode detection
override fun onDeveloperModeDetected() {
    TODO("Not yet implemented")
}

// Flutter Developer mode detection
onDevMode: () => print("Developer mode detected")

// Cordova Developer mode detection
devMode: () => {
    // Place your reaction here
}

// React Native Developer mode detection
devMode: () => {
    // Place your reaction here
}

// Capacitor Developer mode detection
devMode: () => {
    // Place your reaction here
}

We need to ensure that critical security information reaches the right person—or team—responsible for your app.

• Invite Your Team: The business email you provide serves as the foundation for your Organization within the Talsec Portal. Once established, you can invite other developers, security analysts, and managers to a centralized dashboard.

• Prevent Missed Threats: Imagine a new, widespread attack targeting apps like yours. A throwaway email address means you will miss the security alert, leaving your application and users vulnerable.

• Secure Authentication: A valid email is our primary method for verifying your identity & app ownership to ensure that only authorized personnel can access your app's sensitive security data on the Talsec Portal.

• It’s Your Professional Identity: We treat you as a professional partner. A business email helps us to establish a proper communication channel with you.

The Secure Enclave and the Android Keystore system make it very difficult to decrypt sensitive data without physical access to the device. In that order, these keys need to be stored securely. freeRASP checks if the keys reside inside secure hardware.

Below are code snippets demonstrating missing hardware detection across various platforms:

// Android Keystore
override fun onHardwareBackedKeystoreNotAvailableDetected() {
    TODO("Not yet implemented")
}

// iOS Secure Enclave
case missingSecureEnclave

// Flutter HW backed keystore not available and missing secure enclave detection
onSecureHardwareNotAvailable: () => print("Secure hardware not available")

// Cordova HW backed keystore not available and missing secure enclave detection
secureHardwareNotAvailable: () => {
    // Place your reaction here
}

// React Native HW backed keystore not available and missing secure enclave detection
secureHardwareNotAvailable: () => {
    // Place your reaction here
}

// Capacitor HW backed keystore not available and missing secure enclave detection
secureHardwareNotAvailable: () => {
    // Place your reaction here
}

Location spoofing is when an attacker (or malicious app) falsifies the device’s reported location or the location signals it trusts (e.g., GNSS/GPS, Wi‑Fi positioning, cellular location, or IP‑based geolocation), causing the OS and apps to receive incorrect location data.

Location spoofing in mobile apps is commonly used to bypass geofences and region locks, fake presence (e.g., on dating apps or games), create alibis (e.g., on social or parental control apps), or commit location‑based fraud (offers, check‑ins).

Below are code snippets demonstrating debugger detection across various platforms:

// Android location spoofing check
override fun onLocationSpoofingDetected() {
    TODO("Not yet implemented")
}

// Flutter location spoofing detection
onLocationSpoofing: () => print("Multi instance detected")

// Cordova location spoofing detection
locationSpoofing: () => {
    // Place your reaction here
}

// React Native location spoofing detection
locationSpoofing: () => {
    // Place your reaction here
}

// Capacitor location spoofing detection
locationSpoofing: () => {
    // Place your reaction here
}

While most developers use debuggers to trace the flow of their program during its execution same tool can be attached to an application in an attempt to reverse engineer, check memory values, and steal confidential information. This method looks for specific flags to determine whether the debugger is active and offers the option to disable it.

Below are code snippets demonstrating debugger detection across various platforms:

// Android debugger detection
override fun onDebuggerDetected() {
    TODO("Not yet implemented")
}

// iOS debugger detection
case debugger

// Flutter
onDebug: () => print("Debugging")

// Cordova
debug: () => {
    // Place your reaction here 
}

// React Native
debug: () => {
    // Place your reaction here 
}

// Capacitor
debug: () => {
    // Place your reaction here 
}

There are two possible values for this flag:

• true

  • Indicates the Release version.

  • This is the default value when undefined.

• false

  • Indicates the Dev version.

The Dev version of freeRASP is intended for usage during the development phase. It serves the purpose of segregating development and production data, as well as disabling certain checks that are not applicable during the development process. These checks include:

• Emulator usage (onSimulator),

• Debugging (onDebug),

• Signing (onAppIntegrity),

• Unofficial store (onUnofficialStore),

• Obfuscation issues (onObfuscationIssues),

• Developer mode (onDevMode),

• ADB Enabled (onADBEnabled).

Watch the video walkthrough or continue with the step-by-step guide below:

Step 1: Find SHA-256 Hash in Google Play Console

To retrieve the SHA-256 hash in Google Play Console, follow these steps:

Open your app and navigate to Test and release > App integrity > Play app signing. Click on "Settings":

Under App signing key certificate, locate the "SHA-256 certificate fingerprint" (fingerprint = hash):

An example SHA-256 hash looks like this:

88:8c:7f:02:d6:2e:ed:3a:53:bb:9c:a6:6b:82:5c:0d:78:a8:e5:b6:b2:11:28:bc:f5:ac:67:c8:e0:a3:7c:5a

You'll need this value for the next step.

Step 2: Convert the SHA-256 Hash to Base64 Format

Convert the hash to Base64 format, as the SDK requires it in this format. Follow the steps in this section ➡️

Rooting/jailbreaking is a technique of acquiring privileged control over the operating system of an Android/iOS device. While most users root their devices to overcome the limitations put on the devices by the manufacturers, it also enables those with malicious intent to abuse privileged access and steal sensitive information. Many different attack vectors require privileged access to be performed. Tools such as Magisk, Shamiko, Shad0w or Dopamine can hide privileged access and are often used by attackers.

Learn more about the root detection and jailbreak detection.

freeRASP uses various checks to detect whether the device is rooted or jailbroken. It detects not only rooted/jailbroken devices but also looks for the presence of their hiders (e.g., Magisk Hide, Shamiko, Shad0w, Dopamine).

From our data, around 0.5% - 1% of devices have traces of rooting and jailbreaking. Keep that in mind when choosing the appropriate reaction type.

Below are code snippets demonstrating root and jailbreak detection across various platforms:

// Root detection on Android
override fun onRootDetected() {
    TODO("Not yet implemented")
}

// iOS jailbreaking detection
case jailbreak

// Flutter root and jailbreak detection
onPrivilegedAccess: () => print("Privileged access")

// Cordova root and jailbreak detection
privilegedAccess: () => {
    // Place your reaction here
}

// React Native root and jailbreak detection
privilegedAccess: () => {
    // Place your reaction here
}

// Capacitor root and jailbreak detection
privilegedAccess: () => {
    // Place your reaction here
}

The application can be analysed or modified even though its source code has not been changed, applying a technique known as hooking. This technique can be used to intercept system or application calls and then modify them. An attacker can exploit this by inserting new (often malicious) code or by altering existing one to obtain personal client data. The most well-known hooking frameworks are Frida, Xposed, or Cydia Substrate.

Below are code snippets demonstrating hook detection across various platforms:

// Android hook check
override fun onHookDetected() {
    TODO("Not yet implemented")
}

// iOS hook detection
case runtimeManipulation

// Flutter hook and runtime manipulation detection
onHooks: () => print("Hooks")

// Cordova hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// React Native hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// Capacitor hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

The freeRASP contains public API so that the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to use publicly available information to interrupt freeRASP operations or modify your custom reaction implementation in threat callbacks. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also partially randomized for each application so it cannot be automatically abused by generic hooking scripts.

The majority of Android projects support code shrinking and obfuscation without any additional need for setup. The owner of the project can define the set of rules that are usually automatically used when the application is built in the release mode. For detailed guidance, explore the official documentation through these links: first reference and second reference.

Learn More

Explore obfuscation, its types, and Talsec's practical approach—balancing developer experience, app performance, and attack resistance while minimizing drawbacks and ensuring cost-efficient mobile app security:

Types

FreeraspConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

AndroidConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

IOSConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

NativeEventEmitterActions

Specifies a set of callbacks that are used to notify the application when certain security threat is detected.

Actions

Methods

const startFreeRASP = async (config: FreeraspConfig, reactions: NativeEventEmitterActions): Promise<bool>

Method is used to start freeRASP's audit and set up listeners for threats. Returns true when successful.

const removeThreatListeners = (): void

Unregisters threat listeners. Should be called only when the app is being terminated.

const blockScreenCapture = async (enable: boolean): Promise<boolean>

const isScreenCaptureBlocked = async (): Promise<boolean>

📦 Add the dependency

1. From GitHub, Copy into your Application folder.

2. Drag & drop the Talsec folder to your .xcworkspace.

3. Add TalsecRuntime framework to Target > Build Phases > Link Binary With Libraries.

4. In the General > Frameworks, Libraries, and Embedded Content choose Embed & Sign.

Note: In case you are using Carthage, the zipped version of the framework is included in the .

⚙️ Setup the Configuration for your App

To ensure freeRASP functions correctly, you need to provide the necessary configuration. All required values must be filled in for the plugin to operate properly. Use the following template to configure the plugin. Detailed descriptions of the configuration options are provided .

In the AppDelegate import TalsecRuntime and add the following code (e.g., in the didFinishLaunchingWithOptions method.:

👷 Handle detected threats

You can handle the detected events using handlers. For example, you can log the event, show a window to the user or kill the application. See the to learn more details about the performed checks and their importance for app security.

1. Anywhere in your project (e.g. in AppDelegate), add the following code as an extension:

2. Use the code above for handling these types of events:

📱(Optionally) Add screenshot and screen capture blocking

To utilize active screen shot and screen capture (e.g. mirroring, screen recording) protection, you can use Talsec.blockScreenCapture(enable: Bool, window: UIWindow) with specific UIWindow on which it should be blocked. To receive whether the screen capture is blocked in the specific UIWindow, you can use the Talsec.isScreenCaptureBlocked(in window: UIWindow). For more details about all these screen capture methods, see .

🛡️ Start freeRASP

Invoke the following method right after setting up the TalsecConfig in previous steps.

Types

TalsecConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

AndroidConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

IOSConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

NativeEventEmitterActions

Specifies a set of callbacks that are used to notify the application when certain security threat is detected.

Actions

Hooks

const useFreeRasp = (config: TalsecConfig, actions: NativeEventEmitterActions)

React Custom Hook responsible for starting freeRASP and setting up listeners

Methods

const setThreatListeners = async (config: NativeEventEmitterActions): void

Sets up listeners for detected threats

const talsecStart = async (options: TalsecConfig): Promise<string>

Method is used to start freeRASP's audit. Returns 'freeRASP started'string when successful.

const removeThreatListeners = async (): void

Unregisters threat listeners. Should be called only when the app is being terminated.

const blockScreenCapture = async (enable: boolean): Promise<string>

const isScreenCaptureBlocked = async (): Promise<boolean>

This page provides you with all the necessary information about for . Please read it carefully. If you have a question, don't hesitate to .

📦 Install the plugin

In this section, you will implement the imported freeRASP Action.

1. On your app's initial page, navigate to the UI Builder.

2. On the right panel, click on Actions.

3. In the Action Flow Editor box, click Open.

4. In the newly opened window, click on On Page Load at the top.

5. Click Add Action (or + and then Add Action, if you already have an Action).

6. On the right panel, search for the runRASP Custom Action.

7. Select the runRASP Action.

⚙️ Setup the Configuration for your App

The freeRASP Action requires several arguments to be filled to function. Some data are related to specific platforms.

If you are developing the application exclusively for one platform, you can omit the configuration part related to the other platform. If you don't want to provide configuration to an unrelated platform, provide an empty string:

1. Click the orange variable icon next to the Value label

2. Scroll down to Constants

3. Click Constant to expand the dropdown menu

4. Select Empty String

Configuration parameters

watcherMail

watcherMail is an email address designated for receiving security reports. Ensure that the email address follows the strict [email protected] format.

isProd

isProd is a boolean flag that determines whether the freeRASP integration is in the Dev or Release version. If you want to learn more about isProd, visit this .

[Android] packageName

packageName is a unique identifier for your Android application.

You can find the packageName value for your application in FlutterFlow settings:

1. Navigate to Settings and Integrations.

2. Locate and select App Details.

3. In the textbox labelled Package Name, you will find the package name associated with your application.

[Android] signingCertHash

signingCertHash is a hash of the certificate of the key which was used to sign the application. The value of the hash must be encoded in Base64 form.

More about signing hash and how to obtain it in .

[Android] supportedStore (optional)

supportedStore is a third-party app store to which your application is uploaded. By including this store, freeRASP considers it as trusted source.

To add a store, add the package name of the store to the supportedStore list.

[iOS] bundleId

bundleId is a unique identifier for your iOS application.

More about bundle ID and how to obtain one: .

[iOS] teamId

teamId is a unique identifier assigned to a development team enrolled in the Apple Developer Program.

You can find your teamId on the Apple Developer portal:

1. Go to the website: .

2. Log in using the account that is used to sign and release your app.

3. Scroll down to the Membership details section.

4. Look for the line labelled "Team ID" - the value of your team will be displayed there.

👷 Handle detected threats

The freeRASP Action offers multiple callbacks for handling threats. A callback is an that gets triggered when a threat is detected.

To implement callback:

1. Open Action Flow Editor with runRASP action.

2. Open one of the dropdown menus labelled "onX" on the right panel (X for a given type of reaction, for example, onAppIntegrity)

3. In the Action Flow Editor box, click on Open.

4. Implement your reaction.

Visit to learn more details about the performed checks and their importance for app security.

Limitations

Limited configuration

freeRASP for Flutter allows you to define multiple values for:

• Signing certificate hash

• Supported app store

• Bundle ID

Due to FlutterFlow's limitations, the current implementation of freeRASP for FlutterFlow only allows you to specify a single value for each of these attributes. If want to provide more values, you can download the code and adjust those parameters manually (see )

Mobile support only

Currently, freeRASP supports only Android and iOS. When running the application in the FlutterFlow web client, freeRASP will not be initialized.

[Android] Minimal SDK level

The minimum required Android SDK level for freeRASP is 23. FlutterFlow applications have a minimum SDK level of 21 by default.

This creates some restrictions:

• Deploying the application from the FlutterFlow web client is not possible.

• Downloading the APK from the FlutterFlow web client is not supported.

To overcome these limitations, we recommend following these steps:

1. Download the code.

2. Manually raise the SDK level in the build.gradle file to 23.

3. Deploy the application using Google Play Console.

Raising SDK version

1. From the root of your project, go to android > app > build.gradle

2. In defaultConfig update minSdkVersion to at least 23 (Android 6.0) or higher

🖥️ Check Talsec Portal

Check out and register using your watcherMail to see your data. If you integrated the SDK successfully, the application will be present after a few hours. The visualisations will be active later due to the bucketing mechanism.

Device binding is attaching an application instance to a particular mobile device. This method detects a transfer of an application instance to another device. A new install of the application (e.g. in case of buying a new device and transfer the apps) is not detected.

The deviceID detects, whether the has been changed. It is triggered after reinstallation of the application if there are no other applications from the same vendor installed. The value can also change when installing test builds using Xcode or when installing an app on a device using ad-hoc distribution.

Below are code snippets demonstrating device binding detection across various platforms:

Saving any sensitive data on a device without a lock / passcode makes them more prone to theft. With no user authentification device can be accessed and modified with minimal effort. freeRASP checks if the device is secured with any type of lock.

Below are code snippets demonstrating passcode detection across various platforms:

Unsecure Wi‑Fi describes a situation where a device is connected to an open or poorly protected wireless network (for example an open hotspot, weak WPA, or a rogue access point), allowing an attacker to observe, intercept, or alter the device’s traffic and network behavior so the OS and apps communicate over an untrusted link.

Attackers can use unsecured Wi‑Fi to perform man‑in‑the‑middle attacks such as:

• Eavesdrop on unencrypted traffic to harvest credentials and session cookies

• Hijack or replay active sessions to gain unauthorized access

• Present forged or untrusted certificates to perform HTTPS interception

Below are code snippets demonstrating debugger detection across various platforms:

Every application can be easily modified and then resigned by an attacker. This process is known as application repackaging. There may be many reasons for application repackaging, whether it's adding new code, removing app protections, or bypassing app licensing. A modified/tampered application is often distributed using third-party stores or other side channels.

Talsec uses various checks to detect whether the application was tampered (e.g., changed package name, signing hash).

Below are code snippets demonstrating app tampering detection across various platforms:

& Fair Usage Policy

Version Number: 1.1

Effective Date: October 13, 2025

1. Introduction

1. This Fair Usage Policy (“Policy”) is incorporated by reference into the Agreement and governs the permitted use of Talsec’s freeRASP (the “Service”) provided by Lynx SFT s.r.o. (“Talsec”, “Provider”, “we”, “us”, or “our”). By utilizing the Service, the Customer (“you”, “your”) agrees to abide by this Policy.

2. Usage Limits

1. The Service is provided, free of charge, for integration into mobile applications (“Applications”) under the condition that the total cumulative download count across all Applications owned or controlled by the Customer or their organization does not exceed one hundred thousand (100,000) unique devices. For clarity, multiple downloads or updates from the same device are counted as a single download, and the download limit applies collectively to all such Applications per Customer or organization.

2. Exceeding this threshold constitutes a breach of this Policy and obliges the Customer to transition to a commercial subscription plan.

3. Right to Reference Application Name and Logo in Marketing

1. Talsec reserves the right to reference the Application’s name and logo in Talsec’s marketing communications, including, but not limited to, website sections such as “Trusted by”, presentations, and other promotional materials.

4. Data Collection

1. The Service collects and processes security telemetry and threat data. This data is used for product enhancement, operational improvements, and aggregated security insights. By using the Service, you consent to such data collection and processing practices.

2. No personally identifiable information is intentionally collected or processed.

3. App publishers should provide clear disclosure to users in compliance with Google Play and Apple App Store policies.

5. Enforcement and Remedies

1. In the event of suspected or actual usage in breach of this Policy (including but not limited to exceeding limits, or interfering with data collection), Talsec may, at its sole discretion and without prejudice to any other remedies:

   1. Suspend or terminate your license to use the Service,

   2. Withhold or discontinue consolidated security reporting or related services,

   3. Require immediate transition to a commercial subscription plan.

6. Policy Modifications

1. Talsec may revise this Policy at any time. Notice of material changes will be provided by publishing the updated Policy on the Service website. Continued use of the Service after posting will constitute acceptance of those changes.

ADB (Android Debug Bridge) Enabled is a power-user feature activated through the "USB Installation" option in the Developer settings. This state can signal potential security risks, such as apps being installed via USB, the device being connected to a man-in-the-middle (MiTM) proxy, or the device running as an emulator. When ADB is enabled, it allows extensive access to the device, including pulling and pushing files, issuing shell commands, working with the activity manager (e.g., starting activities, broadcasting intents, modifying hidden Android settings, attaching a profiler to a process, or making an app debuggable), and managing packages. Additionally, it enables capturing screenshots, recording the screen, and other actions that can compromise app security and user privacy. FreeRASP detects whether the USB debugging is enabled.

Below are code snippets demonstrating ADB enabled detection across various platforms:

Welcome to the freeRASP wiki page!

This page provides additional information about the product. The main goal is to present clear and easily accessible content that will help you better understand freeRASP. We hope you find it helpful and informative.

What will you find on this Wiki page?

• How to .

• Details on .

• Information about .

• Overview of .

We encourage you to explore the different sections of this wiki to gain a more comprehensive understanding of the freeRASP product and its features. If you have any questions or need further assistance, please feel free to reach out to our support team at [email protected].

Talsec is an academic-based and community-driven mobile security company. We deliver in-App Protection and a User Safety suite for Fintechs. We aim to bridge the gaps between the user's perception of app safety and the strong security requirements of the financial industry.

Talsec offers a wide range of security solutions, such as App and API protection SDK, monitoring services, and the User Safety suite. You can check out the offered products on .

Links

• Give us a ⭐:

• Follow to stay up to date with the news at Talsec:

• Read articles about security issues and their prevention:

Detecting a running VPN service on mobile devices is critical for security-sensitive applications, as it can indicate potential privacy and security risks. VPNs can obscure the user’s actual IP address and route data through servers potentially under external control, which might interfere with geographical restrictions and bypass network security settings intended to protect data integrity and confidentiality. Such anonymising features could be exploited to mask illicit activities, evade compliance controls, or access services from unauthorised regions. FreeRASP checks whether the system VPN is enabled.

Below are code snippets demonstrating system VPN detection across various platforms:

freeRASP performs several security checks to detect potential threats during runtime, each targeting specific attack vectors. Developers and business owners can determine the appropriate response to these incidents, whether by terminating the application, alerting the user, logging the incident details, or choosing to ignore it.

For a detailed explanation of each security check and guidance on selecting an appropriate response, please refer to the individual threat descriptions in the subsections. Remember, the ideal response will depend on your application's specific security needs and use cases.

Sections

• [Android devices only]

• (Keystore/Keychain secure storage check)

• [Android devices only]

• [Android devices only]

• (Screenshot and screen recording detection, block screenshot capture)

• [Android devices only]

We would like to reflect on a few performance and telemetry-related topics that emerge occasionally.

Common Questions:

• Why does it take too long to finish all the checks?

• How to know when all checks are finished?

• When are telemetry data transmitted?

Key Notes:

• Incidents that are triggered during the development (integration & testing) won't happen to a majority of users in the production.

• Callbacks can be invoked slower if the freeRASP backend endpoint is overloaded. Data collection takes precedence. However, do not worry; the application will function as intended, and only callbacks might be a little delayed.

• freeRASP's threat detection operates asynchronously and continuously. The Talsec.start(...) function merely initiates monitoring; it does not perform a synchronous, one-time scan that returns all results immediately. Actual threat detections are reported over time via callbacks.

The Performance

freeRASP works smoothly in production, but it may be tricky to understand all the freeRASP concepts during development. During the integration and testing of the freeRASP, you may have observed that it took longer than expected to get results for all threats (callbacks). You want to get results quickly, respond to threats effectively, and ensure there is no noticeable jankiness in the UI interactions.

freeRASP has to do a lot of work once started. The cold boot is a really intensive moment when all detections must be performed, telemetry data transmitted, and callbacks to your app must be delivered (in this order).

Talsec team efforts and community contributions allow freeRASP to improve the performance and security trade-offs continually by tuning the asynchronous processes, network activity, and internal business logic. Like that time when the internal detector ordering was reworked to significantly speed evaluation based on this reported issue and the telemetry insights about the speed of detectors 👌.

Beware Development vs. Production Environment Bias

Remember the phrase "It is darkest before the dawn"? The integration and testing of freeRASP are inherently accompanied by unintentional threat callbacks invoked by incorrect provisioning of the app's signature (appIntegrity callback), using a simulator for development, an unofficial store (because you haven't published it yet), and others. We've all been there.

It may also seem disconcerting to see that it takes too long until the last expected threat callback invokes. Yet, keep in mind that in production, these incidents won't happen for the genuine unaltered apps run in normal conditions. The performance impact will be negligible. On the contrary, the comfort of a potential attacker and performance degradation in adverse conditions is acceptable.

Cold Boot Telemetry & Best Effort Service

freeRASP collects security diagnostics data (read more in User Data Policies) in accordance with the Fair Usage Policy. Every detected threat is immediately synchronously logged to a common freeRASP backend. Latencies inflicted by the overload of the endpoint are unfortunate, but we continuously improve and scale as much as possible.

Why freeRASP Doesn't "Finish": Understanding Asynchronous Security Monitoring

freeRASP is designed to provide continuous, real-time mobile application security by operating asynchronously in the background. Unlike traditional security scans that might perform a one-time check and deliver all results synchronously, freeRASP constantly monitors for potential threats. When you call Talsec.start(...), it does not execute an immediate, comprehensive scan that finishes and returns a full snapshot of your app's security status. Instead, this function simply initiates the monitoring service, allowing freeRASP to begin its ongoing vigilance.

Due to this asynchronous nature, any immediate attempt to retrieve the security status after Talsec.start(...) is called will likely yield an outdated result. Threat detections happen over time, in the background, and freeRASP communicates these detections through callbacks. These callbacks are functions you define that get triggered when a specific threat (such as a debugger being attached or a screenshot detected) is identified. It is these callbacks that are responsible for updating your application's understanding of the current security state.

It takes some time for freeRASP to actually detect threats and trigger its corresponding callbacks to report them, the callback solution provided for all freeRASP flavors ensures an accurate reflection of freeRASP's ongoing, dynamic threat detections.

Types

TalsecConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

AndroidConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

IOSConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

NativeEventEmitterActions

Specifies a set of callbacks that are used to notify the application when certain security threat is detected.

Actions

Methods

const start = async (config: FreeraspConfig, eventListenerConfig: NativeEventEmitterActions): Promise<void>

Method is used to start freeRASP's audit and set up listeners for threats.

const blockScreenCapture = async (enable: boolean): Promise<string>

const isScreenCaptureBlocked = async (): Promise<boolean>

At Talsec, our commitment goes beyond just providing strong security solutions. We believe in continuously evolving our offerings by actively listening to community feedback and responding to the unique needs of developers. Our goal is not only to protect your applications but also to ensure that your insights and experiences shape our products.

We value your input because we understand that secure and effective development tooling is built through collaboration. Your voice, as a developer, is crucial to making our solutions more robust, dev-friendly, and aligned with real-world challenges.

Issues

We strive to deliver a flawless experience with our software. However, despite our best efforts, occasional bugs or issues may still arise. If you encounter any problems or notice anything that seems out of place, we encourage you to let us know.

Enhancements

If you have ideas that could enhance freeRASP or improve your developer experience, we want to hear from you. We value suggestions from the community, as they reflect real needs and practical experiences.

To share your idea, please open an enhancement issue on our GitHub repository. Your input helps us prioritize features and improvements that matter most to our users.

Enhancements Tracking

We recognize that some ideas are already on our radar and are actively under consideration. To keep track of proposed enhancements and their progress, we use GitHub Projects.

Before submitting a new idea, we recommend reviewing our GitHub Projects board. This will help you see if your suggestion is already being worked on or if similar ideas have been proposed.

💬 Join the Talsec Community!

Are you looking for upcoming events, ways to engage on social media, or a quick overview of our key programs? This is the hub of our community! Visit the main go-to resource for staying connected with Talsec.

Multi-instance refers to the ability to launch multiple instances of the same application—either intentionally (such as through app cloning or multi-user modes) or unintentionally (due to a malicious attack or system bug). Each instance may run in a separate process, which can lead to security, privacy, or data consistency issues—especially in sensitive applications like finance, messaging, or enterprise tools.

Currently, detection of multi-instance using Parallel Space is supported.

Below are code snippets demonstrating passcode detection across various platforms:

// Android multi instance check
override fun onMultiInstanceDetected() {
    TODO("Not yet implemented")
}

// Flutter multi instance detection
onMultiInstance: () => print("Multi instance detected")

// Cordova multi instance detection
multiInstance: () => {
    // Place your reaction here
}

// React Native multi instance detection
multiInstance: () => {
    // Place your reaction here
}

// Capacitor multi instance detection
multiInstance: () => {
    // Place your reaction here
}

Read More

What is multi-instacing, why is it an issue and how to detect it?

Variables

TalsecConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

AndroidConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

IOSConfig

Specifies configuration for instances of the app running on Android devices. See the table below for detailed description of the attributes.

Methods

Future<void> start(TalsecConfig config)

Starts freeRASP with configuration provided in config.

void attachListener(ThreatCallback callback)

Attaches instance of ThreatCallback to freeRASP. If ThreatCallback is already attached, current one will be detached and replaced with callback. When threat is detected, respective callback of ThreatCallback is invoked.

Classes

ThreatCallback

A class which represents a set of callbacks that are used to notify the application when certain security threat is detected. Read more about the meaning of the callbacks in the wiki.

Methods

RaspExecutionStateCallback

A class which represents a set of callbacks that are used to notify the application when state of executing RASP checks changes.

Screenshot Detection

Screenshot detection identifies when a screenshot is taken on a device. Screenshots can expose sensitive app data, such as user credentials, personal content, or confidential information, leading to privacy and security risks. By detecting screenshots, apps can take preventive measures, such as:

• Obscuring sensitive content before the screenshot is captured.

• Notifying users that a screenshot has been taken.

• Logging events for security monitoring and analysis.

Platform-Specific Implementations

// Android screenshot detection
override fun onScreenshotDetected() {
    TODO("Not yet implemented")
}

// iOS screenshot detection
case screenshot

// Flutter screenshot detection
onScreenshot: () => print("Screenshot capture detected")

// React Native, Capacitor and Cordova
screenshot: () => {
  console.log('screenshot');
},

Screen Recording Detection

Screen recording detection helps identify when a device's screen is being recorded. Screen recordings can capture sensitive data, such as user interactions and proprietary app content. By detecting screen recordings, apps can:

• Mask sensitive information during recording.

• Alert users that their screen is being recorded.

• Log events for further security analysis.

Platform-Specific Implementations

// Android screen recording detection
override fun onScreenRecordingDetected() {
    TODO("Not yet implemented")
}

// iOS screen recording and screen mirrorring (AirPlay) detection
case screenRecording

// Flutter screen recording detection and screen mirrorring detection
onScreenRecording: () => print("Screen recording detected")

// React Native, Capacitor and Cordova
screenRecording: () => {
  console.log('screenRecording');
},

Screen Capture Protection

Screen capture protection prevents your app’s content from appearing in screenshots and screen recordings. When enabled, captured images and recordings display a black screen, protecting sensitive information.

To enable or disable protection dynamically, pass true or false.

// Android screen capture protection
Talsec.blockScreenCapture(activity, true)

// iOS screen capture protection
Talsec.blockScreenCapture(enable: true, window: UIWindow)

// Flutter screen capture protection
await Talsec.instance.blockScreenCapture(enabled: true)

// React Native
import { blockScreenCapture } from 'freerasp-react-native';
await blockScreenCapture(true);
// response: Screen capture is now Blocked

// Capacitor
import { blockScreenCapture } from 'capacitor-freerasp';
await blockScreenCapture(true);
// response: true

// Cordova
await talsec.blockScreenCapture(true);
// response: Screen capture is now Blocked