Notes on runtime app protection
Stopping Bot-Driven Checkout Abuse in Retail and E-Commerce Apps
Sneaker bots, gift-card cracking, promo-code abuse — most large-scale retail app abuse runs through emulator farms and hooked clients, not a browser. Where app-layer detection catches what web-only defenses miss.
Where RASP Fits in a Fraud Stack, Next to Behavioral Biometrics
Behavioral biometrics and device intelligence look at how a session behaves. RASP looks at whether the environment it's running in can be trusted at all. Neither replaces the other.
Mobile App Security Compliance in the UAE: NESA and Central Bank Guidance
The UAE doesn't have one named mobile-app framework — NESA's standards cover government and critical infrastructure, the Central Bank covers licensed financial institutions. What both actually expect from a mobile app.
SAMA Cybersecurity Framework: What It Means for Your Mobile Banking App
The Saudi Central Bank's Cybersecurity Framework names application security as one of its core domains. What that looks like in practice for a bank or fintech's mobile app.
APRA CPS 234 and Mobile Banking Apps: A Practical Checklist
CPS 234 doesn't name mobile apps directly, but 'information security capability proportionate to vulnerabilities' has a clear reading for your customer-facing app. A practical checklist for what that means at the app layer.
How a Compromised Device Enables Account Takeover Fraud
Account takeover fraud gets discussed as a credentials problem — stolen passwords, leaked OTPs. A lot of it actually starts one layer down, with a rooted or hooked device the app never questioned.
Mobile App Security Compliance Around the World: A Plain-Language Guide
OWASP MASVS, PCI DSS, Australia's APRA CPS 234, Saudi Arabia's SAMA framework — different names, but they're converging on the same point: secure code at rest isn't enough if you can't say what's happening on the device at runtime.
RASP for React Native and Flutter Apps: What Actually Works
React Native and Flutter apps still compile down to a standard APK. What that means for root, hooking, and tamper detection — and where framework-level SDK integration actually gets harder.
What Is RASP? Runtime Application Self-Protection Explained
RASP checks what's happening on the device while your app is running, not just what the binary looks like at rest. Here's what that means in practice, and where it fits next to static scanning and obfuscation.
App Cloning and Repackaging: How Attackers Do It, How to Catch It
Decompile, patch, resign, redistribute. A walkthrough of the standard app-cloning pipeline and the signature attestation checks that catch a repackaged build.
Code Obfuscation vs. Runtime Protection: Why Mobile Apps Need Both
Obfuscation slows down static analysis. It does nothing once your app is actually running on a hooked or rooted device. Why these are complementary layers, not substitutes.
Emulator and Virtual Device Detection: How It Actually Works
Build fingerprints, sensor gaps, and telephony stubs — the signals that separate a real device from an emulator, and why any single one of them is easy to patch around.
Root Detection Alone Isn't Enough Anymore
A single root check is a single thing to bypass. Why layered environment detection — root, VM, and hooking together — holds up better.
Frida and Xposed: What Anti-Hooking Detection Actually Looks For
A practical look at the fingerprints instrumentation frameworks leave behind in a running process, and why native-layer detection catches more of them.
OWASP MASVS and Where Runtime Protection Fits In
MASVS's resilience requirements (MASVS-RESILIENCE) are explicitly about runtime behavior, not static code review. Mapping RASP controls to the categories an assessor actually checks.
SSL Pinning Certificate Rotation Without Breaking Your App
Certificate pinning fails hard when it fails. A rollout pattern for rotating keys without locking out users on your current release.