Config plugin
What the expo-rampart config plugin changes in your native projects.
Planned behaviour.
The plugin runs during npx expo prebuild. It only adds what the checks you enabled need.
Android
| Change | Why |
|---|---|
Targeted <queries> entries for specific package names | Lets Rampart see known root and hooking managers on Android 11+ without the broad QUERY_ALL_PACKAGES permission, which Google Play restricts. |
DETECT_SCREEN_CAPTURE permission (Android 14+) | Screenshot callbacks for screenCapture. |
DETECT_SCREEN_RECORDING permission (Android 15+) | Screen-recording callbacks for screenCapture. |
HIDE_OVERLAY_WINDOWS permission (Android 12+) | hideOverlayWindows helper. |
| R8 keep rules | Keeps the module's entry points while letting R8 shrink the rest. |
| Release JS bundle hash | Embedded at build time for the tampered check. |
Rampart adds no INTERNET permission.
iOS
| Change | Why |
|---|---|
LSApplicationQueriesSchemes entries | Lets the jailbreak check ask whether known jailbreak-store URL schemes exist. |
| AppDelegate subscriber | Custom-keyboard blocking and the app-switcher shield. |
| Expected team ID, bundle ID, JS bundle hash | Embedded for the tampered check. |
Prebuild warnings
The plugin warns when a release build would still be debuggable, or when expo-dev-client would
ship in a production profile.
Options
["expo-rampart", {
"android": {
"expectedSigningCertSha256": ["AB:CD:…"],
"screenCaptureCallbacks": true,
"hideOverlays": true
},
"ios": {
"expectedTeamId": "ABCDE12345",
"blockCustomKeyboards": true,
"appSwitcherShield": true
},
"jsBundleHash": "auto"
}]