Blog
How mobile app resilience works, and where it stops
Reference articles written for developers and security teams: what each check proves, what it does not, and how to run it in CI. Defensive only.
pix · fraud · android
How Pix remote-access and overlay scams work, and what a banking app can do about them
Brazil's instant payment system attracts Android malware that watches the screen, abuses accessibility and swaps a payee at the last second. A defensive explanation of the pattern, the platform changes of 2026, and the controls an app can add.
7 min readBy Moatgator team
expo · react-native · ci
Securing an Expo or React Native app in CI: a practical pipeline
A step-by-step guide to adding resilience checks to the CI of an Expo or React Native app: build the artifact, scan it, gate on a grade, keep secrets out of the bundle, and authenticate the pipeline without storing a long-lived key.
6 min readBy Moatgator team
owasp-masvs · pentest · resilience
How to pass the resilience item of a mobile pentest: the four MASVS-RESILIENCE controls
Pentest reports for mobile apps often end with a resilience finding. Here is what the four OWASP MASVS-RESILIENCE controls actually ask for, what evidence a tester looks for, and how to close the gaps without false confidence.
8 min readBy Moatgator team
play-integrity · android · attestation
Play Integrity in practice: verdicts, app access risk and the 10,000 requests per day quota
A practical guide to using the Play Integrity API on a real backend: what each verdict means, how to read the app access risk signal, how to design a policy per operation, and how to ask for more than the default daily quota.
7 min readBy Moatgator team
root-detection · jailbreak · attestation
Root and jailbreak detection: what works, what does not, and what to do instead
On-device root and jailbreak checks are easy to add and easy to get wrong. A defensive look at what these checks can and cannot prove, why attestation changes the picture, and how to combine signals into a decision your server controls.
7 min readBy Moatgator team