Introduction
Rampart is an open-source, clean-room runtime protection (RASP) toolkit for React Native and Expo.
Status: in design
Rampart is being designed in the open. The APIs on this site are the planned shape and may change before the first release. Nothing is published to npm yet.
What Rampart is
Rampart is an Expo module (Swift + Kotlin, New Architecture) plus a config plugin. It watches the device and the app at runtime and tells your JavaScript code when something looks wrong:
- the phone is rooted or jailbroken, or hides that it is;
- a hooking framework or debugger is attached;
- the app was repackaged, re-signed, or installed from an untrusted source;
- it runs on an emulator, an unlocked bootloader, or inside a clone / virtual-space app;
- the screen is being captured, recorded or mirrored, or another app draws an overlay;
- risky accessibility services, keyboards or notification listeners are enabled;
- VPN, user-installed CA certificates, mock location or a tampered clock are in play;
- USB debugging or developer mode is on, or the device has no screen lock.
A companion server package verifies Google Play Integrity and Apple App Attest results on your backend, which is where security decisions about money and personal data belong.
How it works
Who it is for
Teams shipping React Native or Expo apps that handle health, payment or other regulated data and want runtime protection without a closed-source SDK or a third-party telemetry pipeline.