🔐 SafetyNet: a full-stack device-security toolkit for iOS, Android, Flutter, and React Native

Jailbreak/root/tamper detection, anti-debugging, and Play Integrity attestation across all four major mobile platforms — one shared design philosophy.
The four pieces:
🍎 SafetyNet (Swift Package) — jailbreak detection, anti-debugging, code-signature integrity, proxy/VPN detection, secure Keychain storage. Zero third-party dependencies.
🤖 SafetyNetAndroid (Kotlin) — root/tamper detection, debugger detection, proxy/VPN detection, Play Integrity API.
🎯 SafetyNetFlutter — one Dart API wrapping both native SDKs.
⚛️ SafetyNetReactNative — one JS API via a TurboModule, same coverage.
Some of what's actually under the hood:
⚡ 9 independent jailbreak signals on iOS (filesystem, injected dylibs, Frida ports, sandbox breach, URL schemes, suspicious processes, Shadow tweaks, symlinks, open ports) — weighted and scored so no single check alone can trigger a critical lockdown. Multiple independent signals have to agree.
🛡️ Anti-debugging via a raw ARM64 syscall (ptrace(PT_DENY_ATTACH)) — issued at a level no hookable libc symbol can intercept.
🎚️ Selective checks (SafetyNetChecks / RootCheck / DebuggerCheck) — run everything, or cherry-pick exactly the signals you want.
🧪 Debug-safe by design — every check short-circuits to a safe value under #if DEBUG / BuildConfig.DEBUG, so it never gets in the way of your own dev workflow.
🔑 A scoped Secure Keychain wrapper isolated from your app's own Keychain usage.
🔄 Proxy/VPN detection now covers Android too — closes the gap between platforms, folded automatically into check() on Flutter and React Native.
The one rule that shapes everything: none of these auto-react. They only report what they find and let the host app decide what to do. No forced logout, no silently disabled UI, no killing the process. That constraint traces back to a real production incident where a library's own auto-reaction silently broke a login screen — "report only" is the whole point.
Play Integrity API support ships across Android, Flutter, and React Native too — request an attestation token from Google, verify it server-side, layer it on top of the on-device checks.
Get it:
📦 iOS — Swift Package Manager: https://lnkd.in/dVD4AgxH (or CocoaPods via a git-based Podfile line — not yet on the CocoaPods trunk)
📦 Android — Maven Central: https://lnkd.in/d8QrWFUQ (1.1.0)
📦 Flutter — pub.dev: https://lnkd.in/dTeYWG9t (1.2.0)
📦 React Native — npm: https://lnkd.in/dihRvhax (0.3.0)
Repos:
🔗 https://lnkd.in/dVD4AgxH
🔗 https://lnkd.in/dggRHj8Q
🔗 https://lnkd.in/djAQQtpk
🔗 https://lnkd.in/dRmzpVP4

mobiledev #iOS #Android #Flutter #ReactNative #AppSecurity #OpenSource