Expo
How to secure an Expo app
Moatgator works on the built artifact, so how you build with Expo does not matter. Scan it today; protecting an Expo app is not available yet.
Protection engineNot available yet
The protection engine is in preview: builds are registered and scanned, but no protected package is produced yet. This page says exactly what works today.
What attackers do to an Expo app
The defensive view of the techniques a protection has to make more expensive.
01
Reading the JavaScript bundle
An Expo app ships a JavaScript bundle inside the package. Anything in it, including keys placed in app config, can be extracted.
02
Public environment variables
Variables meant for the client are bundled into the app by design. A secret placed there is not a secret.
03
Repackaging
The built AAB, APK or IPA can be unpacked, changed and re-signed like any native app.
04
Rooted and jailbroken devices
On a rooted or jailbroken device, tools such as Frida can hook the app while it runs.
What Moatgator plans for Expo
The built artifact is what gets protected, so the plan does not depend on how you produced it.
Works on the artifact
Locally with prebuild and Gradle, or with EAS Build: produce the AAB, APK or IPA, then register it.
One policy at the project root
moatgator.yml reads android.package and ios.bundleIdentifier from app.json. Keep it out of the regenerated android and ios folders.
Detections in the native layer
Root or jailbreak, debugger, hooking and tampering are evaluated natively. They are not available yet.
Signing stays with EAS
EAS manages your signing credentials. Moatgator never needs them.
What works today
No promise of support that does not exist yet.
Free Scan of the packages
Scan the AAB, APK or IPA of your Expo build and get a grade for the protection gaps, read statically.
AvailablePolicy file and CI registration
moatgator.yml detects Expo, and the CLI registers and scans the artifact, built locally or downloaded from EAS. Built and tested; the packages are not published yet.
AvailableExpo protection
Runtime detections and bundle hardening for Expo are not available yet. No protected package is produced.
Not available yet
Scan an Expo build locally
The real flow from the documentation.
$ npx moatgator init$ npx expo prebuild --platform android$ cd android && ./gradlew bundleRelease && cd ..$ npx moatgator scan android/app/build/outputs/bundle/release/app-release.aab --min-grade CThe CLI is not published to npm yet. Until it is, use the free Scan in the browser.
Full Expo quickstartWhat is covered
| Item | Today |
|---|---|
| Package formats (Scan) | AAB, APK and IPA |
| How you build | Locally (prebuild and Gradle) or with EAS Build |
| Policy and CI registration | Any CI that runs Node 20 or newer |
| Expo protection | Not available yet |
Tell me when Expo protection is ready
Leave your email and we will write once, when it is available. Nothing else.
Questions
Can I put an API secret in an Expo environment variable?
Not if it must stay secret. Variables meant for the client end up inside the app. Keep real secrets on a server and give the app short-lived tokens.
Do I need to eject or change my Expo setup?
No. Moatgator works on the built artifact, so it does not matter whether you use prebuild or EAS Build.
Does EAS Build need access to Moatgator keys?
Only if you register the build from there. Use a short-lived credential or an API key stored as a secret, never committed to the repository.
Will prebuild overwrite my policy file?
No, as long as moatgator.yml lives at the project root. The prebuild command regenerates the android and ios folders, not the root.
Ready to protect your app?
Start free, or tell us what you need.