Threat coverage
Every signal Rampart plans to report, per platform, and whether a server-verified anchor exists.
Server anchor means Google or Apple can vouch for this on your backend (Play Integrity, App
Attest, Android key attestation, StoreKit AppTransaction). Those results cannot be forged on the
device. Signals without an anchor are useful risk input but can be hidden by a skilled attacker.
| Signal | What it means | Android | iOS | Server anchor |
|---|---|---|---|---|
privilegedAccess | Device is rooted (Android) or jailbroken (iOS) | ✓ | ✓ | Android ✓ |
rootHidingTools | Tools that hide root/jailbreak from apps are present | ✓ | ✓ | Android ✓ |
hookingFramework | A dynamic instrumentation or hooking framework is loaded into the app | ✓ | ✓ | indirect |
debuggerAttached | A debugger is attached to the app process | ✓ | ✓ | indirect |
tampered | App signature, bundle/package ID, team ID or JS bundle differs from the release | ✓ | ✓ | ✓ |
untrustedInstaller | App was not installed from an expected store | ✓ | ✓ | ✓ |
emulator | App runs on an emulator or simulator | ✓ | ✓ | ✓ |
unlockedBootloader | Bootloader is unlocked / verified boot is off | ✓ | — | Android ✓ |
cloneOrVirtualSpace | App runs as a clone, in a second user/profile, or inside a virtual-space app | ✓ | — | partial |
screenCapture | A screenshot was taken, or the screen is recorded or mirrored | ✓ | ✓ | — |
overlay | Another app draws over this app, or touches arrive while the window is obscured | ✓ | — | — |
accessibilityRisk | Accessibility services that are not genuine accessibility tools are enabled | ✓ | — | — |
uiAutomation | Signs of automated input or instrumentation driving the UI | ✓ | partial | — |
untrustedKeyboard | A non-system keyboard is the active input method | ✓ | helper | — |
notificationListenerRisk | Apps that can read notifications (and one-time codes) are enabled | ✓ | — | — |
systemVpn | Traffic is routed through a system VPN | ✓ | low confidence | — |
userCaInstalled | User-installed CA certificates are trusted | ✓ | guidance | — |
mockLocation | Location comes from a mock provider or is simulated | ✓ | ✓ | — |
timeSpoofing | Device clock was moved or disagrees with your server's time | ✓ | ✓ | ✓ (your server clock) |
usbDebugging | USB or wireless ADB debugging is enabled | ✓ | guidance | — |
developerMode | Developer options are enabled | ✓ | guidance | — |
deviceLockMissing | Device has no PIN, pattern, password or biometric lock | ✓ | ✓ | — |
outdatedOs | OS version or security patch level is below your floor | ✓ | ✓ | partial |
Protective helpers
| Helper | What it does |
|---|---|
secureScreen / <SecureView> | Blocks screenshots, recording and the recents/app-switcher thumbnail for a screen |
appSwitcherShield | Covers the app with a neutral view when it goes to the background (iOS) |
hideOverlayWindows | Asks Android (12+) to hide other apps' overlays while your window is visible |
markAccessibilitySensitive | Hides sensitive views from non-accessibility-tool services (Android 14+) |
blockCustomKeyboards | Forces the system keyboard in the app (iOS) |
reportDigest | Builds a hash that binds a threat report to a Play Integrity / App Attest request |
Grounded in OWASP MASVS
Signals map to the OWASP MASVS RESILIENCE and PLATFORM controls and to the matching MASWE weaknesses (for example MASWE-0051 root and jailbreak detection, MASWE-0039 overlay attacks, MASWE-0040 accessibility leaks). OWASP MAS content is licensed CC BY-SA 4.0 by the OWASP Foundation.