D01
Stock Android phone in a production appValidated
A stock Pixel 10 Pro reports clean with zero signals — in mastercard-rn on 0.2.1, and again on 0.3.0 with the new bootloader check.
How to read this page
A scenario is one test case: prepare the environment, run the steps, then compare the expected result (written before the run) with the observed result (copied from the run, with screenshots).
- D01 · D
- Run on a real phone, used normally.
- Validated
- Run, and the result matched what was expected.
Why it matters
Emulators cannot prove the absence of false positives. This is real hardware, a real app and the published package.
Environment
- App
- mastercard-rn (Expo SDK 53, React Native 0.79.5, New Architecture)
- Device
- Pixel 10 Pro, Android 17 (API 37), stock
- Library
- 0.2.1 from npm
- Build
- Debug, clean prebuild
Setup
Prepare the environment.Then run the steps.
- 01Replace the app’s previous detector with useDeviceIntegrity and a fail-closed gate.
- 02Install on the phone.
Steps
What to run.What to read.
- 01Open the app.
- 02Read the [device-integrity] log line in Metro.
- 03Check the app reaches its login screen.
Expected result · written before the run
Status: cleanNo signals.
Observed result · copied from the run
Status: cleanObserved 2026-09-30.
Re-confirmed on library 0.3.0 (2026-10-06), which adds bootloader_unlocked, compromising by default: the same phone running the example app's release build (non-debuggable, built from the v0.3.0 tag) reported clean with zero signals on three cold starts (46–52 ms). Its boot properties are what a locked stock phone reports — ro.boot.verifiedbootstate green, ro.boot.flash.locked 1, ro.boot.vbmeta.device_state locked, release-keys — so bootloader_unlocked correctly stays quiet.
[device-integrity] {"status": "clean", "signalIds": [], "durationMs": 374} · login screen reached
Checks this scenario covers
Every check this test case touches — including ones that aren't expected to fire here. The expected and observed results above say which ones should and did. Each links to how the check works.