Currently, there are no commonly present issues solely for the Capacitor development platform. For more general issues or questions, visit FAQ page. You can also check out the Issues section of our GitHub repository, where you can report issues and view existing reports.

While most developers use debuggers to trace the flow of their program during its execution same tool can be attached to an application in an attempt to reverse engineer, check memory values, and steal confidential information. This method looks for specific flags to determine whether the debugger is active and offers the option to disable it.

Below are code snippets demonstrating debugger detection across various platforms:

// Android debugger detection
override fun onDebug() {
    TODO("Not yet implemented")
}

// iOS debugger detection
case debugger

// Flutter
onDebug: () => print("Debugging")

// Cordova
debug: () => {
    // Place your reaction here 
}

// React Native
debug: () => {
    // Place your reaction here 
}

// Capacitor
debug: () => {
    // Place your reaction here 
}

Welcome to the freeRASP wiki page!

This page provides additional information about the product. The main goal is to present clear and easily accessible content that will help you better understand freeRASP. We hope you find it helpful and informative.

What will you find on this Wiki page?

• How to Get the Signing Certificate Hash.

• Details on Callback Delay, Telemetry Impact, and Threat Scanning.

• Information about .

• Overview of .

We encourage you to explore the different sections of this wiki to gain a more comprehensive understanding of the freeRASP product and its features. If you have any questions or need further assistance, please feel free to reach out to our support team at support@talsec.atlassian.net.

Select the product you want to integrate to access dedicated deployment guides, security configurations, and technical references.

Core Security Modules

Developer Resources

Quickly access essential tools and additional information to manage your security posture.

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

Currently, there are no commonly present issues solely for the Native iOS development platform. For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

Currently, there are no commonly present issues solely for the Capacitor development platform. For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

Running an application inside an emulator/simulator allows an attacker to hook or trace program execution. For applications running inside an emulator, it is easy to inspect the system's state, reset it to a saved image, or monitor how the app operates. Keep in mind that not every emulator/simulator usage means an ongoing potential threat for the application.

Below are code snippets demonstrating emulator detection across various platforms:

The Secure Enclave and the Android Keystore system make it very difficult to decrypt sensitive data without physical access to the device. In that order, these keys need to be stored securely. freeRASP checks if the keys reside inside secure hardware.

Below are code snippets demonstrating missing hardware detection across various platforms:

Saving any sensitive data on a device without a lock / passcode makes them more prone to theft. With no user authentification device can be accessed and modified with minimal effort. freeRASP checks if the device is secured with any type of lock.

Below are code snippets demonstrating passcode detection across various platforms:

Android developer mode allows deeper system access and debugging capabilities that can bypass app security measures. Developer mode can enable settings that facilitate the installation of uncertified applications and the execution of potentially harmful code, posing significant risks to data integrity and app functionality. FreeRASP detects whether the developer mode is enabled.

Warning: This vulnerability is particularly critical on Android 12 and 13 devices with Developer Mode enabled. A local attacker with ADB shell access can execute arbitrary code within the context of any non-system app, granting them full access to the app’s private data files, AccountManager-stored credentials, and other privileged resources. This bypasses the Application Sandbox’s intended protections, which are designed to isolate app data even from device owners.

Below are code snippets demonstrating developer mode detection across various platforms:

Multi-instance refers to the ability to launch multiple instances of the same application—either intentionally (such as through app cloning or multi-user modes) or unintentionally (due to a malicious attack or system bug). Each instance may run in a separate process, which can lead to security, privacy, or data consistency issues—especially in sensitive applications like finance, messaging, or enterprise tools.

Currently, detection of multi-instance using is supported.

Below are code snippets demonstrating passcode detection across various platforms:

What is multi-instacing, why is it an issue and how to detect it?

Location spoofing is when an attacker (or malicious app) falsifies the device’s reported location or the location signals it trusts (e.g., GNSS/GPS, Wi‑Fi positioning, cellular location, or IP‑based geolocation), causing the OS and apps to receive incorrect location data.

Location spoofing in mobile apps is commonly used to bypass geofences and region locks, fake presence (e.g., on dating apps or games), create alibis (e.g., on social or parental control apps), or commit location‑based fraud (offers, check‑ins).

Below are code snippets demonstrating debugger detection across various platforms:

Every application can be easily modified and then resigned by an attacker. This process is known as application repackaging. There may be many reasons for application repackaging, whether it's adding new code, removing app protections, or bypassing app licensing. A modified/tampered application is often distributed using third-party stores or other side channels.

Talsec uses various checks to detect whether the application was tampered (e.g., changed package name, signing hash).

Below are code snippets demonstrating app tampering detection across various platforms:

// Android tampering
override fun onAppIntegrity() {
    TODO("Not yet implemented")
}

// iOS signature
case signature

// Flutter tampering and signature detection
onAppIntegrity: () => print("App integrity")

// Cordova tampering and signature detection
appIntegrity: () => {
    // Place your reaction here
}

// React Native tampering and signature detection
appIntegrity: () => {
    // Place your reaction here
}

// Capacitor tampering and signature detection
appIntegrity: () => {
    // Place your reaction here
}

App Data Migration detection identifies situations where application data is restored, transferred, and reused on a different physical device. This behavior can indicate that sensitive application state, credentials, or tokens have been migrated outside the original environment.

On iOS, deviceID detects whether the device identifier has changed. It is triggered after the app is reinstalled if no other apps from the same vendor are installed. The value can also change when you install test builds with Xcode or distribute the app ad hoc.

Below are code snippets showing how this feature is reported across various platforms:

The freeRASP SDK contains public API, so the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to interrupt freeRASP SDK operations or modify the custom code in threat callbacks. All internal freeRASP classes are already obfuscated, so it is simple to distinguish freeRASP sources from the rest of the application code during the static analysis. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also to make it partially randomized for each application so it cannot be automatically abused by generic hooking scripts.

Please follow the integration guide of your platform for more information about how to obfuscate the app.

Below are code snippets demonstrating missing obfuscation detection across various platforms:

// Android
override fun onObfuscationIssues() {
    TODO("Not yet implemented")
}

// Flutter
onObfuscationIssues: () => print("Obfuscation issues")

// Cordova
obfuscationIssues: () => {
    // Place your reaction here
},

// React Native
obfuscationIssues: () => {
    // Place your reaction here
},

// Capacitor
obfuscationIssues: () => {
    // Place your reaction here
},

Detecting a running VPN service on mobile devices is critical for security-sensitive applications, as it can indicate potential privacy and security risks. VPNs can obscure the user’s actual IP address and route data through servers potentially under external control, which might interfere with geographical restrictions and bypass network security settings intended to protect data integrity and confidentiality. Such anonymising features could be exploited to mask illicit activities, evade compliance controls, or access services from unauthorised regions. FreeRASP checks whether the system VPN is enabled.

Below are code snippets demonstrating system VPN detection across various platforms:

// Android system VPN detection
override fun onSystemVpn() {
    TODO("Not yet implemented")
}

// iOS system VPN detection
case systemVPN

// Flutter system VPN detection
onSystemVPN: () => print("System VPN detected")

// Cordova system VPN detection
systemVPN: () => {
    // Place your reaction here
}

// React Native system VPN detection
systemVPN: () => {
    // Place your reaction here
}

// Capacitor system VPN detection
systemVPN: () => {
    // Place your reaction here
}

ADB (Android Debug Bridge) Enabled is a power-user feature activated through the "USB Installation" option in the Developer settings. This state can signal potential security risks, such as apps being installed via USB, the device being connected to a man-in-the-middle (MiTM) proxy, or the device running as an emulator.

When ADB is enabled (either via USB or Wireless/Wi-Fi), it allows extensive access to the device, including pulling and pushing files, issuing shell commands, working with the activity manager (e.g., starting activities, broadcasting intents, modifying hidden Android settings, attaching a profiler to a process, or making an app debuggable), and managing packages. Additionally, it enables capturing screenshots, recording the screen, and other actions that can compromise app security and user privacy.

FreeRASP monitors and detects whether any form of ADB debugging is active on the device, providing protection against both physical and network-based debugging attempts.

Below are code snippets demonstrating ADB enabled detection across various platforms:

// Android ADB enabled detection
override fun onAdbEnabled() {
    TODO("Not yet implemented")
}

// Flutter ADB enabled detection
onADBEnabled: () => print("ADB Enabled detected")

// Cordova ADB enabled detection
adbEnabled: () => {
    // Place your reaction here
}

// React Native ADB enabled detection
adbEnabled: () => {
    // Place your reaction here
}

// Capacitor ADB enabled detection
adbEnabled: () => {
    // Place your reaction here
}

freeRASP for React Native is a bare React Native plugin. When installing freeRASP into a project that uses Expo SDK, there may be extra configuration needed.

To integrate freeRASP into the Expo projects, follow the instructions for React Native. After that, continue on this page.

We provide a plugin config that sets up the dependencies of freeRASP without the need to eject the Expo project. It is recommended to use the plugin config. However, manual setup is also possible.

Plugin config setup

Add the plugin config to your app.json and specify the minSdkVersion (use at least 23).

"plugins":[
    [
        "freerasp-react-native/app.plugin.js",
        {
            "android":{
                "minSdkVersion":"23",
            }
        }
    ]
]

Manual setup

1. Increase minSdkVersion

   This can be done in two ways:

   • update the minSdkVersion property directly in android/build.gradle, or

   • use expo-build-properties plugin, which updates the property in the prebuild phase. .

2. Add maven dependency

   1. open android/build.gradle (if you don't see the android folder, run npx expo prebuild -p android in terminal to create it)

   2. add the following dependency under allprojects > repositories

What is Signing Certificate Hash?

All Android apps must be signed with a digital certificate before installation. The signing certificate SHA-256 hash in Base64 form - which we'll refer to as the hash for short, also known as a fingerprint -is the certificate's unique identifier, crucial for security and integrity. The Talsec SDK uses this hash for app tampering detection.

Choose Your Signing Method

The first step is to determine which app signing method you're using.

If you're using Google Play App Signing, a very common practice for Android App Bundles (AAB) distribution, your upload key and distribution key are distinct. So, be sure to use the app signing certificate key from the Google Play Console. Proceed with the Google Play App Signing Method.

If you're managing your own signing key (Manual App Signing), you'll need to generate the hash yourself from your keystore, proceed with the Manual App Signing Method.

Continue with the method that matches your signing process ➡️

Watch the video walkthrough or continue with the step-by-step guide below:

Step 1: Find SHA-256 Hash in Google Play Console

To retrieve the SHA-256 hash in Google Play Console, follow these steps:

Open your app and navigate to Test and release > App integrity > Play app signing. Click on "Settings":

Under App signing key certificate, locate the "SHA-256 certificate fingerprint" (fingerprint = hash):

An example SHA-256 hash looks like this:

88:8c:7f:02:d6:2e:ed:3a:53:bb:9c:a6:6b:82:5c:0d:78:a8:e5:b6:b2:11:28:bc:f5:ac:67:c8:e0:a3:7c:5a

You'll need this value for the next step.

Step 2: Convert the SHA-256 Hash to Base64 Format

Convert the hash to Base64 format, as the SDK requires it in this format. Follow the steps in ➡️

Step 1: Use Your Release Keystore to Get the SHA-256 Hash

A common mistake is using the wrong signing key, which will cause the Talsec SDK to flag your app as a security risk. To avoid this, you must use the keystore that signs your app for public release.

Here’s the difference:

• Debug Keystore: Created automatically by Android Studio. DO NOT USE THIS ONE. It is insecure and only for development purposes.

• Release Keystore: The secure keystore you create and manage. USE THIS ONE. It's what permanently ties your app to you as the developer.

If you haven't created a release keystore yet, the will walk you through the process.

You can use tools like keytool or apksigner to retrieve certificate details, including the SHA-256 hash. Choose whichever is most convenient: get the hash from your signed release APK or directly from your release keystore:

This command will output the certificate details, including the SHA-256 hash, which will look something like this:

You'll need this value for the next step.

Convert the hash to Base64 format, as the SDK requires it in this format. Follow the steps in ➡️

Step 1: Convert to Base64

To convert the hash to Base64 form, use an online tool like Base64 Encode:

After conversion, you'll receive a final Base64 string like this:

iIx/AtYu7TpAu5cma4JdDXio5bayFSi89axnyOCjfFo=

Step 2: Use resulting string in your Talsec configuration ✅

Your work here is done. Insert it into your Talsec configuration.

Example of a Talsec freeRASP configuration in Flutter with the resulting string:

freeRASP performs several security checks to detect potential threats during runtime, each targeting specific attack vectors. Developers and business owners can determine the appropriate response to these incidents, whether by terminating the application, alerting the user, logging the incident details, or choosing to ignore it.

For a detailed explanation of each security check and guidance on selecting an appropriate response, please refer to the individual threat descriptions in the subsections. Remember, the ideal response will depend on your application's specific security needs and use cases.

Sections

• Detecting rooted or jailbroken devices

• (formerly Device Binding)

• [Android devices only]

• (Keystore/Keychain secure storage check)

• [Android devices only]

• [Android devices only]

• (Screenshot and screen recording detection, block screenshot capture)

• [Android devices only]

Rooting/jailbreaking is a technique of acquiring privileged control over the operating system of an Android/iOS device. While most users root their devices to overcome the limitations put on the devices by the manufacturers, it also enables those with malicious intent to abuse privileged access and steal sensitive information. Many different attack vectors require privileged access to be performed. Tools such as Magisk, Shamiko, Shad0w or Dopamine can hide privileged access and are often used by attackers.

Learn more about the root detection and jailbreak detection.

freeRASP uses various checks to detect whether the device is rooted or jailbroken. It detects not only rooted/jailbroken devices but also looks for the presence of their hiders (e.g., Magisk Hide, Shamiko, Shad0w, Dopamine).

From our data, around 0.5% - 1% of devices have traces of rooting and jailbreaking. Keep that in mind when choosing the appropriate reaction type.

Below are code snippets demonstrating root and jailbreak detection across various platforms:

// Root detection on Android
override fun onPrivilegedAccess() {
    TODO("Not yet implemented")
}

// iOS jailbreaking detection
case jailbreak

// Flutter root and jailbreak detection
onPrivilegedAccess: () => print("Privileged access")

// Cordova root and jailbreak detection
privilegedAccess: () => {
    // Place your reaction here
}

// React Native root and jailbreak detection
privilegedAccess: () => {
    // Place your reaction here
}

// Capacitor root and jailbreak detection
privilegedAccess: () => {
    // Place your reaction here
}

The application can be analysed or modified even though its source code has not been changed, applying a technique known as hooking. This technique can be used to intercept system or application calls and then modify them. An attacker can exploit this by inserting new (often malicious) code or by altering existing one to obtain personal client data. The most well-known hooking frameworks are Frida, Xposed, or Cydia Substrate.

Below are code snippets demonstrating hook detection across various platforms:

// Android hook check
override fun onHooks() {
    TODO("Not yet implemented")
}

// iOS hook detection
case runtimeManipulation

// Flutter hook and runtime manipulation detection
onHooks: () => print("Hooks")

// Cordova hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// React Native hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// Capacitor hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

Unsecure Wi‑Fi describes a situation where a device is connected to an open or poorly protected wireless network (for example an open hotspot, weak WPA, or a rogue access point), allowing an attacker to observe, intercept, or alter the device’s traffic and network behavior so the OS and apps communicate over an untrusted link.

Attackers can use unsecured Wi‑Fi to perform man‑in‑the‑middle attacks such as:

• Eavesdrop on unencrypted traffic to harvest credentials and session cookies

• Hijack or replay active sessions to gain unauthorized access

• Present forged or untrusted certificates to perform HTTPS interception

Below are code snippets demonstrating unsecure wifi detection across various platforms:

The general flow of the integration can be decomposed into the following steps:

1. Conforming to the prerequisites, e.g. setting up Android minSdkVersion.

2. Adding the dependency.

3. Setting up the configuration for the application, e.g. package name or whether it is production or not (see ).

4. Handling the detected threats (callbacks).

5. Starting the SDK.

6. Enabling the source code obfuscation.

7. Registering in to see the data from your apps and compare it to global statistics.

8. Become familiar with and .

9. Looking at , to provide an additional layer of protection by detecting malware or suspicious applications.

10. Looking at if you are interested in more advanced solutions to protect your application and business.

11. Reading through and , if you are interested in more detailed information about internal workings.

The Dev version is intended for development purposes. It allows you to work on your app without interference from security features that could disrupt the process, e.g. if you would implement killing of the application on the debugger callback.

The Release version is meant for production and must always be used for your published app. It enables all security protections provided by freeRASP.

To configure this, set the isProd flag in freeRASP:

• Release: isProd = true

• Dev: isProd = false

⚠️Dev version disables some detections which won't be triggered during the development process:

• Emulator/Simulator

• Debugging

• Tampering/Repackaging

• Unofficial store/source

Choose the relevant section based on your app development platform:

freeRASP is a lightweight and easy-to-integrate mobile security library designed to detect potential threats during the application's runtime. It contains multiple security checks, each aimed to cover possible attack vectors to ensure a high level of application security.

freeRASP provides detection of potentially dangerous behaviour, including the following:

• Using

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

We would like to reflect on a few performance and telemetry-related topics that emerge occasionally.

Common Questions:

• Why does it take too long to finish all the checks?

• How to know when all checks are finished?

• When are telemetry data transmitted?

Time spoofing attack is when an attacker (or malicious app) manipulates the device's clock or its time source (e.g. network, GPS, or NTP) to cause system apps to behave incorrectly.

Time spoofing in mobile apps is often used to extend or reuse expired tokens, OTPs, or sessions, bypass trial periods and usage quotas, and skip waiting or cooldown times for time‑restricted features, giving attackers or unauthorised users continued access or unfair advantages.

Below are code snippets demonstrating time spoofing detection across various platforms:

There are two possible values for this flag:

• true

  • Indicates the Release version.

  • This is the default value when undefined.

The App Blocklists layer evaluates installed applications against a locally cached list of malicious identifiers. This deterministic check matches either the exact Package Name or the SHA-256 Hash of the installed application.

You can configure both types of identifiers simultaneously, or use only one by omitting the unused parameter.

This check extracts the application's unique package identifier (e.g., com.malicious.stealer) and compares it against a predefined list.

• Execution: Performs a direct string comparison against the OS package manager's inventory.

This project is provided as freemium software, i.e. there is a fair usage policy that imposes some limitations on the free usage. The SDK software consists of open-source and binary parts, which is the property of Talsec. The open-source part is licensed under the MIT License - see the LICENSE file on GitHub for details.

During build time, the SDK obtains a cached license token bound to your application/library package name/namespace and version. During the build process it outputs a clear breakdown of this setup directly to your console, for example:

============================================================
  Talsec Plugin Configuration
============================================================
  - Resolving default project config
    - Project type: Application
    - Package/namespace: com.example.app
    - Version name: 1.0.0
  - Free/Community plan
    - SDK config: FreeConfig(sdkVersion=19.3.0, offlineToken=, platform=)
  - Talsec plugin applied successfully

============================================================
  License Check
============================================================
  - Using online status
  - License status: ALLOWED

Variables

TalsecConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

public static func start(config: TalsecRuntime.TalsecConfig)

• The method used to start freeRASP's audit.

public static func blockScreenCapture(enable: Bool, window: UIWindow)

• The method blocks the screen capture in specific UIWindow.

public static func isScreenCaptureBlocked(in window: UIWindow) -> Bool

• The method returns whether the screen capture is blocked in specific UIWindow.

public static func storeExternalId(externalId: String)

• The method stores an externalId into the logs for data collection.

func threatDetected(_ securityThreat: TalsecRuntime.SecurityThreat)

• Notifier about detected threats.

func onAllChecksFinished()

• Notifier about finished threats

Provides all types of threats detected by freeRASP. Read more about the meaning of the threats in the .

• signature

• jailbreak

• debugger

The most frequent issues occurring during integration:

General

Android Devices

iOS Devices

For more general issues or questions, visit FAQ page. You can also check out the Issues section of our GitHub repository, where you can report issues and view existing reports.

🖥️ Talsec Portal

Access real-time security insights, global benchmarks, and detailed analytics!

Talsec Portal is a centralized dashboard that visualizes the security data collected by freeRASP from your app, giving you real-time insights into threats, incidents, and benchmarks—so if you're using freeRASP, this is where your app's security intelligence lives.

• 📊 Real-Time Threat Monitoring: Gain insights into threat counts, types, and occurrences over time.

• 📈 Global Benchmarking: Benchmark your app's security against global statistics.

• 📚 Stay informed: Read the latest articles and documentation on app security best practices.

Details about incidents:

Details about devices:

• OS version

• Screen lock

• Biometrics

• Hardware-backed Keystore

Real-time activity logs from the application, showing ongoing threats.

1. Visit the .

2. Run through the onboarding wizard and explore demo data.

3. Discover insights using demo applications and global security statistics.

1. Click on Login, then Sign Up.

2. Use the email address () associated with your TalsecConfig.

3. Create an Organization.

Now, you can view data for your applications. You can invite other users to your organization to see your data (see Organization Settings). The users can also add their applications to your organization to share their data.

The freeMalwareDetection SDK enables your Android application to identify potentially harmful applications installed on the same user device.

The SDK evaluates the device ecosystem using on-device metadata analysis — including app hash-based and package name-based blocklists, requested app permissions, and the source of installation. All scanning runs entirely on the device, ensuring that no application inventory or user data is ever transmitted to external servers.

It operates asynchronously in the background to avoid impacting your app's performance. High-risk findings are reported directly to your application via callbacks, allowing you to implement custom, context-aware security logic.

Supported Platforms

The Android application ecosystem and distribution models allow attackers to distribute malicious apps (often requesting sensitive permissions) designed to exploit or intervene in other applications on the device. Users are frequently tricked into sideloading these applications from untrusted sources via social engineering.

Such malware is often created and distributed specifically to target high-value applications. The freeMalwareDetection SDK defends against these threats by analyzing metadata and heuristic signals — evaluating requested permissions, installation sources, and known blocklists — entirely on the device, with no internet connection required.

To ensure a secure environment, the freeMalwareDetection SDK is specifically engineered to identify apps that facilitate activities such as:

• Remote Access Trojans (RATs) & Overlays: Applications requesting aggressive permission sets to control the device remotely, draw fake UI layers (e.g., login screens) over your application, or read the content of the screen.

• Communication Interception: Apps designed to make or accept calls, intervene in network communications, or act as SMS stealers to intercept incoming 2FA codes.

• Accessibility Abuse & Keylogging: Malicious apps abusing Android Accessibility Services to autonomously click buttons on behalf of the user, approve background transactions, or log keyboard inputs.

To tackle these complex threats without compromising your app's UX, privacy, or battery life, the SDK provides the following core capabilities:

• Customizable Blocklists: Easily define and manage multiple types of blocklists (e.g., hash-based or package name-based) to tailor malware detection to your specific threat model.

• Asynchronous Scanning: All evaluations are performed in a low-priority background thread, ensuring minimum impact on your application's foreground performance.

• 100% On-Device Privacy: All scanning is completely self-contained. No app inventory, hashes, or behavioral data leaves the device.

The bootloader is the first component that runs when a device powers on, and a locked bootloader is the foundation of Android's Verified Boot and hardware root of trust. Bootloader detection identifies when the device bootloader is unlocked or when Verified Boot is otherwise compromised, meaning the device can no longer be trusted. The check relies on hardware-backed Key Attestation (Root of Trust) rather than easily spoofable system properties.

Attackers unlock the bootloader or weaken Verified Boot to:

• Install custom firmware or a custom ROM, disabling OS-level security guarantees.

• Gain root access and bypass integrity protections, allowing tampering with the app and other apps' data.

• Prepare the environment for further tampering and dynamic analysis.

Below are code snippets demonstrating bootloader detection:

The freeRASP contains public API so that the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to use publicly available information to interrupt freeRASP operations or modify your custom reaction implementation in threat callbacks. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also partially randomized for each application so it cannot be automatically abused by generic hooking scripts.

The majority of Android projects support code shrinking and obfuscation without any additional need for setup. The owner of the project can define the set of rules that are usually automatically used when the application is built in the release mode. For detailed guidance, explore the official documentation through these links: first reference and second reference.

Learn More

Explore obfuscation, its types, and Talsec's practical approach—balancing developer experience, app performance, and attack resistance while minimizing drawbacks and ensuring cost-efficient mobile app security:

Automation detection identifies when the application is being controlled, analyzed, or interacted with by automated testing frameworks (specifically targeting Appium and UI Automator). This describes a situation where software, rather than a human, is driving the application's UI.

Attackers use automation tools to simulate user actions at high speed and scale to perform attacks such as:

• Bot Farms: Automating actions like account creation, voting, or transaction execution to manipulate platform metrics or defraud the system.

• Data Scraping: Automatically navigating the app to extract proprietary data, content, or user information.

• Dynamic Analysis: Rapidly probing the application logic and UI flows to discover vulnerabilities or bypass security checks.

Below are code snippets demonstrating automation detection:

We need to ensure that critical security information reaches the right person—or team—responsible for your app.

• Invite Your Team: The business email you provide serves as the foundation for your Organization within the Talsec Portal. Once established, you can invite other developers, security analysts, and managers to a centralized dashboard.

• Prevent Missed Threats: Imagine a new, widespread attack targeting apps like yours. A throwaway email address means you will miss the security alert, leaving your application and users vulnerable.

• Secure Authentication: A valid email is our primary method for verifying your identity & app ownership to ensure that only authorized personnel can access your app's sensitive security data on the .

• It’s Your Professional Identity: We treat you as a professional partner. A business email helps us to establish a proper communication channel with you.

Once you have successfully integrated the freeMalware Detection module and configured your detection settings, you should verify your setup.

To safely test the integration without exposing your development device to real malware, download our official test samples below. These APKs are completely harmless but are specifically designed to trigger the detection engine.

Once downloaded and sideloaded onto your test device, observe the malware callback. Based on your configuration, you can expect the following:

• Detection Trigger: These samples request highly sensitive permissions (e.g., READ_SMS, BIND_ACCESSIBILITY_SERVICE) and are installed from outside a trusted source.

• Expected Flags: The callback will report these applications with one or more of the following reasons:

  • installSource — the application was sideloaded from an untrusted installer.

  • suspiciousPermission — the application requests dangerous permission combinations matching your configured sets.

  • blocklist

Talsec is an academic-based and community-driven mobile security company. We deliver in-App Protection and a User Safety suite for Fintechs. We aim to bridge the gaps between the user's perception of app safety and the strong security requirements of the financial industry.

Talsec offers a wide range of security solutions, such as App and API protection SDK, monitoring services, and the User Safety suite. You can check out the offered products on our web.

Links

• Give us a ⭐: GitHub freeRASP

• Follow to stay up to date with the news at Talsec:

• Read articles about security issues and their prevention:

This curated AI prompt is designed to get the freeRASP into your app to save you time. The AI cannot make security decisions for you.

1. ➡️ Open your AI coding assistant & your IDE

2. ➡️ Proceed with steps related to your AI coding assistant (see tabs below)

3. ⚠️ Finally, read again and manually configure TalsecConfig and threat reactions

If you want to learn about the differences between freeRASP and BusinessRASP+, you’re in the right place. On this page, we’ll explore the key features and benefits of each option, compare their functionalities, and highlight how the BusinessRASP+ subscription can offer enhanced capabilities and support compared to the freeRASP plan. By the end, you’ll have a clear understanding of which solution best meets your needs and how to make the most of it.

freeRASP is a freemium product, which means there are . For using freeRASP, please refer to the .

and are premium products with a subscription model (which includes SW licenses, SLA, maintenance updates, and more) for SDKs. It is not SaaS, which means we don't introduce any dependency on third-party web services for your mobile solution.

Talsec doesn't collect any customer data within RASP+, while freeRASP SDK sends the diagnostical information to Talsec servers to provide clients with regular security reports and improve the product. You should consider adding Talsec to the list of Data Processors in case of freeRASP usage.

Here are the top 10 benefits of choosing a Talsec RASP+ Business subscription, which includes an SDK license, SLA, and additional services, compared to the freeRASP option.

For any questions, please refer to our or schedule a call with us by choosing a time slot on

Before configuring the freeMalware Detection module, ensure the application environment meets the following baseline technical prerequisites.

The freeMalwareDetection SDK utilizes a Defense-in-Depth architecture. Because no single scanning methodology can identify every type of threat without generating excessive false positives, the device environment is evaluated across multiple distinct analytical layers. This section documents the specific mechanisms the engine uses to evaluate installed applications.

The detection pipeline operates through two consecutive stages, scaling from fast, deterministic checks to complex, behavioral intelligence:

& Fair Usage Policy

Version Number: 1.1

Effective Date: October 13, 2025

1. This Fair Usage Policy (“Policy”) is incorporated by reference into the Agreement and governs the permitted use of Talsec’s freeRASP (the “Service”) provided by Lynx SFT s.r.o. (“Talsec”, “Provider”, “we”, “us”, or “our”). By utilizing the Service, the Customer (“you”, “your”) agrees to abide by this Policy.

At Talsec, our commitment goes beyond just providing strong security solutions. We believe in continuously evolving our offerings by actively listening to community feedback and responding to the unique needs of developers. Our goal is not only to protect your applications but also to ensure that your insights and experiences shape our products.

We value your input because we understand that secure and effective development tooling is built through collaboration. Your voice, as a developer, is crucial to making our solutions more robust, dev-friendly, and aligned with real-world challenges.

We strive to deliver a flawless experience with our software. However, despite our best efforts, occasional bugs or issues may still arise. If you encounter any problems or notice anything that seems out of place, we encourage you to let us know.

If you have ideas that could enhance freeRASP or improve your developer experience, we want to hear from you. We value suggestions from the community, as they reflect real needs and practical experiences.

To share your idea, please open an enhancement issue on our GitHub repository. Your input helps us prioritize features and improvements that matter most to our users.

Users can share a copy of the application on unofficial stores or various pirate forums. While some users download these copies to avoid paying for the product, they can include unknown and possibly dangerous modifications. Verifying an official installation consequently protects both the users and the owner. This reaction is also triggered, if you install the application through alternative ways like unofficial store or Xcode build.

Below are code snippets demonstrating detection of unofficial installation across various platforms:

// Android
override fun onUnofficialStore() {...}

// iOS
case unofficialStore

// Flutter
onUnofficialStore: () => print("Unofficial store")

// Cordova 
unofficialStore: () => {
    // Place your reaction here 
}

// React Native
unofficialStore: () => {
    // Place your reaction here 
}

// Capacitor
unofficialStore: () => {
    // Place your reaction here 
}

Define alternative supported stores

If you want to define which applications can install the application, insert its package name in the supportedAlternativeStores (or supportedStores on Flutter) parameter. If you publish on Google Play, Huawei AppGallery, App Store (iOS), and TestFlight (iOS), you don't need to assign anything, as they are already supported out of the box.

The application can also be installed by "cloning" apps, which users employ to transfer apps between devices. The following list comprises popular examples of such apps. By default, freeRASP categorizes them as installations from an unofficial store .

Finally, it's very common application gets installed through browser, file manager, cloud storage or various messaging apps. By default, freeRASP categorizes them as installations from unofficial store.

freeRASP requires a minimum iOS 13+.

1. From GitHub, Copy into your Application folder.

2. Drag & drop the Talsec folder to your .xcworkspace.

This page provides you with all the necessary information about for . Please read it carefully. If you have a question, don't hesitate to .

In this section, you will implement the imported freeRASP Action.

1. On your app's initial page, navigate to the UI Builder.

2. On the right panel, click on Actions.

Screenshot detection identifies when a screenshot is taken on a device. Screenshots can expose sensitive app data, such as user credentials, personal content, or confidential information, leading to privacy and security risks. By detecting screenshots, apps can take preventive measures, such as:

• Obscuring sensitive content before the screenshot is captured.

• Notifying users that a screenshot has been taken.

• Logging events for security monitoring and analysis.

The evaluation mode determines how the SDK decides which applications constitute threats, based on the signals available at scan time.

The specific logic depends on your integration version:

• Modern (V2) integrations: Explicitly controlled by the reasonMode parameter — choose between strict AND logic (HIGHEST_CONFIDENCE) or broad OR logic (ALL).

The freeRASP and freeMalwareDetection modules collect anonymized security diagnostics data from apps. These data contain:

• Application state and security.

• Device state and security.

• Anonymous app instance ID and device ID.