Currently, there are no commonly present issues solely for the Native iOS development platform. For more general issues or questions, visit FAQ page. You can also check out the Issues section of our GitHub repository, where you can report issues and view existing reports.

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

The most frequent issues occurring during integration:

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

The general flow of the integration can be decomposed into the following steps:

1. Conforming to the prerequisites, e.g. setting up Android minSdkVersion.

2. Adding the dependency.

Variables

TalsecConfig

Specifies configuration for your app. See the table below for a detailed description of the attributes.

Classes

class ThreatListener

Constructor

constructor(threatsCallback: ThreatDetected, deviceStateCallback: DeviceState? = null, raspExecutionCallback: RaspExecutionState? = null)

• Listener for the threats detected by freeRASP.

Methods

fun registerListener(context: Context)

• Registers your reactions to detected threats with freeRASP.

fun unregisterListener(context: Context)

• Unregisters the reactions to detected threats.

object Talsec

Methods

fun start(context: Context, config: TalsecConfig, mode: TalsecMode? = TalsecMode.BACKGROUND)

• The method used to start freeRASP's functionality. TalsecMode is an optional parameter that can be used to force the execution of freeRASP in FOREGROUND / BACKGROUND thread (default value is TalsecMode.BACKGROUND).

fun blockScreenCapture(activity: Activity, enable: Boolean)

• The method used to block/unblock screen capture.

fun isScreenCaptureBlocked(): Boolean

• The method used to know the state of screen capture blocking whether blocked or not.

fun storeExternalId(context: Context, externalId: String): ExternalIdResult

• Validates and stores a custom identifier (External ID) for the user.

  • Requirements:

    • Allowed characters: Alphanumeric (a-z, A-Z, 0-9) and special characters: +, _

fun removeExternalId(context: Context)

• Removes the previously stored External ID.

Abstract Classes

public abstract class ThreatDetected

Sends callbacks to your app when a threat is detected. Read more about the meaning of the callbacks in the .

Methods:

• open fun onRootDetected()

• open fun onDebuggerDetected()

• open fun onEmulatorDetected()

abstract class DeviceState

Provides device state listener to get additional information about device state. Read more about the meaning of the device state listeners in the .

Methods:

• open fun onUnlockedDeviceDetected()

• open fun onHardwareBackedKeystoreNotAvailableDetected()

• open fun onDeveloperModeDetected()

abstract class RaspExecutionState

A class which represents a set of callbacks that are used to notify the application when state of executing RASP checks changes.

Methods:

• open fun onAllChecksFinished()

sealed interface ExternalIdResult

Represents the result of the storeExternalId operation.

Subclasses:

• class Success - Indicates that the externalId was successfully validated and stored.

• class Error(val errorMsg: String) - Indicates that validation failed due to invalid characters. Contains a description of the error.

The most frequent issues occurring during integration:

General

Android Devices

iOS Devices

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

How to use this

This curated AI prompt is designed to get the freeRASP into your app to save you time. The AI cannot make security decisions for you.

Steps

1. ➡️ Open your AI coding assistant & your IDE

2. ➡️ Proceed with steps related to your AI coding assistant (see tabs below)

3. ⚠️ Finally, read again and manually configure TalsecConfig and threat reactions

Choose your AI assistant:

freeRASP for React Native is a bare React Native plugin. When installing freeRASP into a project that uses Expo SDK, there may be extra configuration needed.

To integrate freeRASP into the Expo projects, follow the instructions for React Native. After that, continue on this page.

We provide a plugin config that sets up the dependencies of freeRASP without the need to eject the Expo project. It is recommended to use the plugin config. However, manual setup is also possible.

Plugin config setup

Add the plugin config to your app.json and specify the minSdkVersion (use at least 23).

Manual setup

1. Increase minSdkVersion

   This can be done in two ways:

   • update the minSdkVersion property directly in android/build.gradle, or

freeRASP is a lightweight and easy-to-integrate mobile security library designed to detect potential threats during the application's runtime. It contains multiple security checks, each aimed to cover possible attack vectors to ensure a high level of application security.

What does freeRASP do?

freeRASP provides detection of potentially dangerous behaviour, including the following:

The most frequent issues occurring during integration:

General

Android Devices

iOS Devices

For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

Variables

TalsecConfig

Specifies configuration for your app. See the table below for detailed description of the attributes.

Classes

public class Talsec

Methods

public static func start(config: TalsecRuntime.TalsecConfig)

• The method used to start freeRASP's audit.

public static func blockScreenCapture(enable: Bool, window: UIWindow)

• The method blocks the screen capture in specific UIWindow.

public static func isScreenCaptureBlocked(in window: UIWindow) -> Bool

• The method returns whether the screen capture is blocked in specific UIWindow.

public static func storeExternalId(externalId: String)

• The method stores an externalId into the logs for data collection.

Protocols

public protocol SecurityThreatHandler

Methods

func threatDetected(_ securityThreat: TalsecRuntime.SecurityThreat)

• Notifier about detected threats.

public protocol TalsecRuntume.RaspExecutionState

Methods

func onAllChecksFinished()

• Notifier about finished threats

Enums

public enum SecurityThreat : String, Codable, CaseIterable, Equatable

Provides all types of threats detected by freeRASP. Read more about the meaning of the threats in the .

Cases

• signature

• jailbreak

• debugger

Welcome to the freeRASP wiki page!

This page provides additional information about the product. The main goal is to present clear and easily accessible content that will help you better understand freeRASP. We hope you find it helpful and informative.

What will you find on this Wiki page?

• How to .

• Details on .

• Information about .

• Overview of .

We encourage you to explore the different sections of this wiki to gain a more comprehensive understanding of the freeRASP product and its features. If you have any questions or need further assistance, please feel free to reach out to our support team at [email protected].

📝 Prerequisites

freeRASP requires a minimum iOS

Watch the video walkthrough or continue with the step-by-step guide below:

Step 1: Find SHA-256 Hash in Google Play Console

To retrieve the SHA-256 hash in , follow these steps:

Open your app and navigate to Test and release > App integrity > Play app signing.

freeRASP performs several security checks to detect potential threats during runtime, each targeting specific attack vectors. Developers and business owners can determine the appropriate response to these incidents, whether by terminating the application, alerting the user, logging the incident details, or choosing to ignore it.

For a detailed explanation of each security check and guidance on selecting an appropriate response, please refer to the individual threat descriptions in the subsections. Remember, the ideal response will depend on your application's specific security needs and use cases.

Currently, there are no commonly present issues solely for the Capacitor development platform. For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

Automation detection identifies when the application is being controlled, analyzed, or interacted with by automated testing frameworks (specifically targeting Appium and UI Automator). This describes a situation where software, rather than a human, is driving the application's UI.

Attackers use automation tools to simulate user actions at high speed and scale to perform attacks such as:

• Bot Farms: Automating actions like account creation, voting, or transaction execution to manipulate platform metrics or defraud the system.

• Data Scraping

The Secure Enclave and the Android Keystore system make it very difficult to decrypt sensitive data without physical access to the device. In that order, these keys need to be stored securely. freeRASP checks if the keys reside inside secure hardware.

Below are code snippets demonstrating missing hardware detection across various platforms:

// Android Keystore
override fun onHardwareBackedKeystoreNotAvailableDetected() {
    TODO("Not yet implemented")
}

// iOS Secure Enclave
case missingSecureEnclave

// Flutter HW backed keystore not available and missing secure enclave detection
onSecureHardwareNotAvailable: () => print("Secure hardware not available")

// Cordova HW backed keystore not available and missing secure enclave detection
secureHardwareNotAvailable: () => {
    // Place your reaction here
}

// React Native HW backed keystore not available and missing secure enclave detection
secureHardwareNotAvailable: () => {
    // Place your reaction here
}

// Capacitor HW backed keystore not available and missing secure enclave detection
secureHardwareNotAvailable: () => {
    // Place your reaction here
}

Time spoofing attack is when an attacker (or malicious app) manipulates the device's clock or its time source (e.g. network, GPS, or NTP) to cause system apps to behave incorrectly.

Time spoofing in mobile apps is often used to extend or reuse expired tokens, OTPs, or sessions, bypass trial periods and usage quotas, and skip waiting or cooldown times for time‑restricted features, giving attackers or unauthorised users continued access or unfair advantages.

Below are code snippets demonstrating time spoofing detection across various platforms:

// Android timeSpoofing check
override fun onTimeSpoofingDetected() {
    TODO("Not yet implemented")
}

// iOS timeSpoofing detection
case timeSpoofing

// Flutter time spoofing detection
onTimeSpoofing: () => print("Time spoofing detected")

// Cordova time spoofing detection
timeSpoofing: () => {
    // Place your reaction here
}

// React Native time spoofing detection
timeSpoofing: () => {
    // Place your reaction here
}

// Capacitor time spoofing detection
timeSpoofing: () => {
    // Place your reaction here
}

Location spoofing is when an attacker (or malicious app) falsifies the device’s reported location or the location signals it trusts (e.g., GNSS/GPS, Wi‑Fi positioning, cellular location, or IP‑based geolocation), causing the OS and apps to receive incorrect location data.

Location spoofing in mobile apps is commonly used to bypass geofences and region locks, fake presence (e.g., on dating apps or games), create alibis (e.g., on social or parental control apps), or commit location‑based fraud (offers, check‑ins).

Below are code snippets demonstrating debugger detection across various platforms:

// Android location spoofing check
override fun onLocationSpoofingDetected() {
    TODO("Not yet implemented")
}

// Flutter location spoofing detection
onLocationSpoofing: () => print("Multi instance detected")

// Cordova location spoofing detection
locationSpoofing: () => {
    // Place your reaction here
}

// React Native location spoofing detection
locationSpoofing: () => {
    // Place your reaction here
}

// Capacitor location spoofing detection
locationSpoofing: () => {
    // Place your reaction here
}

App Data Migration detection identifies situations where application data is restored, transferred, and reused on a different physical device. This behavior can indicate that sensitive application state, credentials, or tokens have been migrated outside the original environment.

The deviceID detects, whether the device identifier has been changed. It is triggered after reinstallation of the application if there are no other applications from the same vendor installed. The value can also change when installing test builds using Xcode or when installing an app on a device using ad-hoc distribution.

Below are code snippets demonstrating device binding detection across various platforms:

Step 1: Use Your Release Keystore to Get the SHA-256 Hash

A common mistake is using the wrong signing key, which will cause the Talsec SDK to flag your app as a security risk. To avoid this, you must use the keystore that signs your app for public release.

Here’s the difference:

• Debug Keystore: Created automatically by Android Studio. DO NOT USE THIS ONE. It is insecure and only for development purposes.

• Release Keystore: The secure keystore you create and manage. USE THIS ONE. It's what permanently ties your app to you as the developer.

If you haven't created a release keystore yet, the will walk you through the process.

Step 2: Retrieve SHA-256 Hash

You can use tools like keytool or apksigner to retrieve certificate details, including the SHA-256 hash. Choose whichever is most convenient: get the hash from your signed release APK or directly from your release keystore:

This command will output the certificate details, including the SHA-256 hash, which will look something like this:

You'll need this value for the next step.

Step 3: Convert the SHA-256 Hash to Base64 Format

Convert the hash to Base64 format, as the SDK requires it in this format. Follow the steps in ➡️

Step 1: Convert to Base64

To convert the hash to Base64 form, use an online tool like Base64 Encode:

After conversion, you'll receive a final Base64 string like this:

iIx/AtYu7TpAu5cma4JdDXio5bayFSi89axnyOCjfFo=

Step 2: Use resulting string in your Talsec configuration ✅

Your work here is done. Insert it into your Talsec configuration.

Example of a Talsec freeRASP configuration in Flutter with the resulting string:

Rooting/jailbreaking is a technique of acquiring privileged control over the operating system of an Android/iOS device. While most users root their devices to overcome the limitations put on the devices by the manufacturers, it also enables those with malicious intent to abuse privileged access and steal sensitive information. Many different attack vectors require privileged access to be performed. Tools such as Magisk, Shamiko, Shad0w or Dopamine can hide privileged access and are often used by attackers.

Learn more about the root detection and jailbreak detection.

freeRASP uses various checks to detect whether the device is rooted or jailbroken. It detects not only rooted/jailbroken devices but also looks for the presence of their hiders (e.g., Magisk Hide, Shamiko, Shad0w, Dopamine).

From our data, around 0.5% - 1% of devices have traces of rooting and jailbreaking. Keep that in mind when choosing the appropriate reaction type.

Below are code snippets demonstrating root and jailbreak detection across various platforms:

Talsec is an academic-based and community-driven mobile security company. We deliver in-App Protection and a User Safety suite for Fintechs. We aim to bridge the gaps between the user's perception of app safety and the strong security requirements of the financial industry.

Talsec offers a wide range of security solutions, such as App and API protection SDK, monitoring services, and the User Safety suite. You can check out the offered products on our web.

Links

• Give us a ⭐:

• Follow to stay up to date with the news at Talsec:

• Read articles about security issues and their prevention:

There are two possible values for this flag:

• true

  • Indicates the Release version.

  • This is the default value when undefined.

• false

  • Indicates the Dev version.

The Dev version of freeRASP is intended for usage during the development phase. It serves the purpose of segregating development and production data, as well as disabling certain checks that are not applicable during the development process. These checks include:

• Emulator usage (onSimulator),

• Debugging (onDebug),

• Signing (onAppIntegrity),

This page provides you with all the necessary information about for . Please read it carefully. If you have a question, don't hesitate to .

📦 Install the plugin

In this section, you will implement the imported freeRASP Action.

What is Signing Certificate Hash?

All Android apps must be signed with a digital certificate before installation. The signing certificate SHA-256 hash in Base64 form - which we'll refer to as the hash for short, also known as a fingerprint -is the certificate's unique identifier, crucial for security and integrity. The Talsec SDK uses this hash for .

Saving any sensitive data on a device without a lock / passcode makes them more prone to theft. With no user authentification device can be accessed and modified with minimal effort. freeRASP checks if the device is secured with any type of lock.

Below are code snippets demonstrating passcode detection across various platforms:

Multi-instance refers to the ability to launch multiple instances of the same application—either intentionally (such as through app cloning or multi-user modes) or unintentionally (due to a malicious attack or system bug). Each instance may run in a separate process, which can lead to security, privacy, or data consistency issues—especially in sensitive applications like finance, messaging, or enterprise tools.

Currently, detection of multi-instance using is supported.

Below are code snippets demonstrating passcode detection across various platforms:

ADB (Android Debug Bridge) Enabled is a power-user feature activated through the "USB Installation" option in the Developer settings. This state can signal potential security risks, such as apps being installed via USB, the device being connected to a man-in-the-middle (MiTM) proxy, or the device running as an emulator.

When ADB is enabled (either via USB or Wireless/Wi-Fi), it allows extensive access to the device, including pulling and pushing files, issuing shell commands, working with the activity manager (e.g., starting activities, broadcasting intents, modifying hidden Android settings, attaching a profiler to a process, or making an app debuggable), and managing packages. Additionally, it enables capturing screenshots, recording the screen, and other actions that can compromise app security and user privacy.

FreeRASP monitors and detects whether any form of ADB debugging is active on the device, providing protection against both physical and network-based debugging attempts.

Below are code snippets demonstrating ADB enabled detection across various platforms:

We need to ensure that critical security information reaches the right person—or team—responsible for your app.

Android developer mode allows deeper system access and debugging capabilities that can bypass app security measures. Developer mode can enable settings that facilitate the installation of uncertified applications and the execution of potentially harmful code, posing significant risks to data integrity and app functionality. FreeRASP detects whether the developer mode is enabled.

Warning: This vulnerability is particularly critical on Android 12 and 13 devices with Developer Mode enabled. A local attacker with ADB shell access can execute arbitrary code within the context of any non-system app, granting them full access to the app’s private data files, AccountManager-stored credentials, and other privileged resources. This bypasses the Application Sandbox’s intended protections, which are designed to isolate app data even from device owners.

Below are code snippets demonstrating developer mode detection across various platforms:

Running an application inside an emulator/simulator allows an attacker to hook or trace program execution. For applications running inside an emulator, it is easy to inspect the system's state, reset it to a saved image, or monitor how the app operates. Keep in mind that not every emulator/simulator usage means an ongoing potential threat for the application.

Below are code snippets demonstrating emulator detection across various platforms:

Unsecure Wi‑Fi describes a situation where a device is connected to an open or poorly protected wireless network (for example an open hotspot, weak WPA, or a rogue access point), allowing an attacker to observe, intercept, or alter the device’s traffic and network behavior so the OS and apps communicate over an untrusted link.

Attackers can use unsecured Wi‑Fi to perform man‑in‑the‑middle attacks such as:

• Eavesdrop on unencrypted traffic to harvest credentials and session cookies

• Hijack or replay active sessions to gain unauthorized access

Detecting a running VPN service on mobile devices is critical for security-sensitive applications, as it can indicate potential privacy and security risks. VPNs can obscure the user’s actual IP address and route data through servers potentially under external control, which might interfere with geographical restrictions and bypass network security settings intended to protect data integrity and confidentiality. Such anonymising features could be exploited to mask illicit activities, evade compliance controls, or access services from unauthorised regions. FreeRASP checks whether the system VPN is enabled.

Below are code snippets demonstrating system VPN detection across various platforms:

Every application can be easily modified and then resigned by an attacker. This process is known as application repackaging. There may be many reasons for application repackaging, whether it's adding new code, removing app protections, or bypassing app licensing. A modified/tampered application is often distributed using third-party stores or other side channels.

Talsec uses various checks to detect whether the application was tampered (e.g., changed package name, signing hash).

Below are code snippets demonstrating app tampering detection across various platforms:

This project is provided as freemium software, i.e. there is a that imposes some limitations on the free usage. The SDK software consists of open-source and binary parts, which is the property of Talsec. The open-source part is licensed under the MIT License - see the file on GitHub for details.

Currently, there are no commonly present issues solely for the Capacitor development platform. For more general issues or questions, visit page. You can also check out the , where you can report issues and view existing reports.

While most developers use debuggers to trace the flow of their program during its execution same tool can be attached to an application in an attempt to reverse engineer, check memory values, and steal confidential information. This method looks for specific flags to determine whether the debugger is active and offers the option to disable it.

Below are code snippets demonstrating debugger detection across various platforms:

// Android debugger detection
override fun onDebuggerDetected() {
    TODO("Not yet implemented")
}

// iOS debugger detection
case debugger

// Flutter
onDebug: () => print("Debugging")

// Cordova
debug: () => {
    // Place your reaction here 
}

// React Native
debug: () => {
    // Place your reaction here 
}

// Capacitor
debug: () => {
    // Place your reaction here 
}

The freeRASP SDK contains public API, so the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to interrupt freeRASP SDK operations or modify the custom code in threat callbacks. All internal freeRASP classes are already obfuscated, so it is simple to distinguish freeRASP sources from the rest of the application code during the static analysis. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also to make it partially randomized for each application so it cannot be automatically abused by generic hooking scripts.

Please follow the integration guide of your platform for more information about how to obfuscate the app.

Below are code snippets demonstrating missing obfuscation detection across various platforms:

// Android
override fun onObfuscationIssuesDetected() {
    TODO("Not yet implemented")
}

// Flutter
onObfuscationIssues: () => print("Obfuscation issues")

// Cordova
obfuscationIssues: () => {
    // Place your reaction here
},

// React Native
obfuscationIssues: () => {
    // Place your reaction here
},

// Capacitor
obfuscationIssues: () => {
    // Place your reaction here
},

🖥️ Talsec Portal

Access real-time security insights, global benchmarks, and detailed analytics!

Talsec Portal is a centralized dashboard that visualizes the security data collected by freeRASP from your app, giving you real-time insights into threats, incidents, and benchmarks—so if you're using freeRASP, this is where your app's security intelligence lives.

• 📊 Real-Time Threat Monitoring: Gain insights into threat counts, types, and occurrences over time.

• 📈 Global Benchmarking: Benchmark your app's security against global statistics.

• 📚 Stay informed: Read the latest articles and documentation on app security best practices.

Watch the Demo

✨ Features

🛡️ Security incidents

Details about incidents:

📱 Device info

Details about devices:

• OS version

• Screen lock

• Biometrics

• Hardware-backed Keystore

🧾 Activity log

Real-time activity logs from the application, showing ongoing threats.

🔑 Access

🚀 Initial Steps

1. Visit the .

2. Run through the onboarding wizard and explore demo data.

3. Discover insights using demo applications and global security statistics.

🔐 Accessing Your Account

1. Click on Login, then Sign Up.

2. Use the email address () associated with your TalsecConfig.

3. Create an Organization.

Now, you can view data for your applications. You can invite other users to your organization to see your data (see Organization Settings). The users can also add their applications to your organization to share their data.

The application can be analysed or modified even though its source code has not been changed, applying a technique known as hooking. This technique can be used to intercept system or application calls and then modify them. An attacker can exploit this by inserting new (often malicious) code or by altering existing one to obtain personal client data. The most well-known hooking frameworks are Frida, Xposed, or Cydia Substrate.

Below are code snippets demonstrating hook detection across various platforms:

// Android hook check
override fun onHookDetected() {
    TODO("Not yet implemented")
}

// iOS hook detection
case runtimeManipulation

// Flutter hook and runtime manipulation detection
onHooks: () => print("Hooks")

// Cordova hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// React Native hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

// Capacitor hook and runtime manipulation detection
hooks: () => {
    // Place your reaction here
}

At Talsec, our commitment goes beyond just providing strong security solutions. We believe in continuously evolving our offerings by actively listening to community feedback and responding to the unique needs of developers. Our goal is not only to protect your applications but also to ensure that your insights and experiences shape our products.

We value your input because we understand that secure and effective development tooling is built through collaboration. Your voice, as a developer, is crucial to making our solutions more robust, dev-friendly, and aligned with real-world challenges.

Issues

We strive to deliver a flawless experience with our software. However, despite our best efforts, occasional bugs or issues may still arise. If you encounter any problems or notice anything that seems out of place, we encourage you to let us know.

Enhancements

If you have ideas that could enhance freeRASP or improve your developer experience, we want to hear from you. We value suggestions from the community, as they reflect real needs and practical experiences.

To share your idea, please open an enhancement issue on our GitHub repository. Your input helps us prioritize features and improvements that matter most to our users.

Enhancements Tracking

We recognize that some ideas are already on our radar and are actively under consideration. To keep track of proposed enhancements and their progress, we use GitHub Projects.

Before submitting a new idea, we recommend reviewing our GitHub Projects board. This will help you see if your suggestion is already being worked on or if similar ideas have been proposed.

💬 Join the Talsec Community!

Are you looking for upcoming events, ways to engage on social media, or a quick overview of our key programs? This is the hub of our community! Visit the main go-to resource for staying connected with Talsec.

The freeRASP contains public API so that the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to use publicly available information to interrupt freeRASP operations or modify your custom reaction implementation in threat callbacks. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also partially randomized for each application so it cannot be automatically abused by generic hooking scripts.

The majority of Android projects support code shrinking and obfuscation without any additional need for setup. The owner of the project can define the set of rules that are usually automatically used when the application is built in the release mode. For detailed guidance, explore the official documentation through these links: first reference and second reference.

Learn More

Explore obfuscation, its types, and Talsec's practical approach—balancing developer experience, app performance, and attack resistance while minimizing drawbacks and ensuring cost-efficient mobile app security:

Types

TalsecConfig

Variables

TalsecConfig

freeRASP collects anonymized security diagnostics data from apps. These data contain:

• Application state and security.

• Device state and security.

& Fair Usage Policy

Version Number: 1.1

Effective Date: October 13, 2025

1. Introduction