iOS
iOS app protection: jailbreak detection and anti-tampering
iOS is harder to attack than Android, not immune. Scan an IPA today; the iOS protection itself is not available yet, and this page says so plainly.
Protection engineNot available yet
The protection engine is in preview: builds are registered and scanned, but no protected package is produced yet. This page says exactly what works today.
What attackers do to an iOS app
The defensive view of the techniques a protection has to make more expensive.
01
Jailbroken devices
On a jailbroken device the sandbox is open, so other code can read the app's memory and files and change how it behaves.
02
Instrumentation
Tools such as Frida attach to a running app and hook functions, for example to bypass a local authentication check.
03
Re-signed and modified IPAs
A downloaded IPA can be patched and re-signed with another certificate and sideloaded, which a tamper check can notice.
04
Secrets in the bundle
Keys and tokens left in strings, plists or embedded files can be read from the IPA without running the app.
What Moatgator plans for iOS
The same model as Android: a policy file, detections that start in monitor mode, and your pipeline keeps the certificates.
Policy as code
The same moatgator.yml, with your bundle id. On iOS the root detection means jailbreak.
Detections
Jailbreak, debugger, hooking and tampering are the first targets for iOS.
Your certificates stay yours
Moatgator never holds your certificates or provisioning profiles. Signing stays in your pipeline.
Monitor first
Nothing blocks a user until you choose it.
What works today
No promise of support that does not exist yet.
Free Scan of an IPA
Upload an IPA and get a grade for protection gaps, mapped to OWASP MASVS, read statically.
AvailablePolicy file and CI registration
moatgator.yml accepts your bundle id, and the CLI registers and scans the IPA your pipeline produces. Built and tested; the packages are not published yet.
AvailableiOS protection engine
Hardening and runtime detections for iOS are not available yet. No protected IPA is produced.
Not available yet
Scan an IPA from your pipeline
Moatgator does not build your iOS app: archiving and signing depend on your certificates, which it never holds.
$ npx moatgator init --bundle-id com.acme.pay$ npx moatgator scan build/ipa/MyApp.ipa --min-grade CThe CLI is not published to npm yet. Until it is, use the free Scan in the browser.
Full iOS quickstartWhat is covered
| Item | Today |
|---|---|
| Package format (Scan) | IPA |
| Build tool | Xcode, run by your own pipeline on macOS |
| Policy and CI registration | Any CI that runs Node 20 or newer |
| Protected IPA | Not available yet |
Tell me when iOS protection is ready
Leave your email and we will write once, when it is available. Nothing else.
Questions
Is iOS protection available?
Not yet. The Scan reads an IPA and the CLI registers your builds, but no protection is applied to an iOS app today. We will not claim support that does not exist.
Why does the CLI need a macOS runner?
It does not. Only your own iOS build does, because Xcode runs on macOS. The Moatgator CLI needs Node 20 or newer.
Do I have to hand over my certificates?
No, and we will not ask. Certificates and provisioning profiles stay in your pipeline.
Can I still use the Scan on an iOS app?
Yes. Upload the IPA and you get a grade and the gaps it found, with no account.
Ready to protect your app?
Start free, or tell us what you need.