React Native
Root detection and app protection for React Native
Your JavaScript ships inside the app, next to the native code. Scan the packages today; protecting a React Native app is not available yet, and we say what is real.
Protection engineNot available yet
The protection engine is in preview: builds are registered and scanned, but no protected package is produced yet. This page says exactly what works today.
What attackers do to a React Native app
The defensive view of the techniques a protection has to make more expensive.
01
Reading the JavaScript bundle
The bundle ships inside the package. Hermes bytecode is harder to read than plain JavaScript, but it is not a secret store.
02
Rooted and jailbroken devices
Root detection in React Native is only as good as the signals behind it: a single check in JavaScript is easy to patch.
03
Patching the bundle
Changing the bundle and re-signing the app can remove a check or change a flow without touching the native code.
04
Instrumentation
Frida and similar tools can hook both the native side and the JavaScript engine of a running app.
What Moatgator plans for React Native
One policy file for the whole app, applied to the native shell and, later, to the bundle.
One moatgator.yml
A single policy at the project root covers the android and ios folders. The GitHub App detects React Native and monorepos.
Detections in the native layer
Root or jailbreak, debugger, hooking and tampering are evaluated natively, not in a JavaScript check that a patch can remove.
Bundle protection
Protecting the Hermes bundle is planned and is not available yet.
Monitor first
Everything starts in monitor mode, so you see your own false positives before anything blocks.
What works today
No promise of support that does not exist yet.
Free Scan of the packages
Scan the AAB, APK or IPA your React Native build produces and get a grade for the protection gaps, read statically.
AvailablePolicy file and CI registration
moatgator.yml detects React Native, and the CLI registers and scans the artifacts. Built and tested; the packages are not published yet.
AvailableReact Native protection
Hardening of the bundle and runtime detections for React Native are not available yet. No protected package is produced.
Not available yet
Scan the Android build of a React Native app
The real flow from the documentation.
$ npx moatgator init$ cd android && ./gradlew bundleRelease && cd ..$ npx moatgator scan android/app/build/outputs/bundle/release/app-release.aab --min-grade CThe CLI is not published to npm yet. Until it is, use the free Scan in the browser.
Full React Native quickstartWhat is covered
| Item | Today |
|---|---|
| Package formats (Scan) | AAB, APK and IPA |
| Project type | React Native, detected from package.json |
| Policy and CI registration | Any CI that runs Node 20 or newer |
| Bundle protection | Not available yet |
Tell me when React Native protection is ready
Leave your email and we will write once, when it is available. Nothing else.
Questions
Does root detection work in React Native today?
Not as a protection. The runtime detections are not available yet. What works is the policy file, the CI registration and the Scan, which reads your packages statically.
Is the Hermes bytecode safe to keep secrets in?
No. It is harder to read than a plain bundle, but anything shipped inside the app can be extracted. Keep keys and tokens out of it.
How does it work in a monorepo?
Keep one moatgator.yml per app folder, validate each one with the CLI, and point the Action at the right file. The GitHub App creates one per detected app.
Does it replace server-side checks?
No. A detection is a signal, not proof of fraud. Use it together with your own backend checks.
Ready to protect your app?
Start free, or tell us what you need.