WEBVTT

1
00:00:00.600 --> 00:00:07.625
This is react-native-device-integrity: device integrity signals for React Native and Expo.

2
00:00:08.075 --> 00:00:14.750
Here is the whole package in a few minutes: what it checks, how it decides, how to use it, and where it stops.

3
00:00:15.200 --> 00:00:19.100
This overview covers version 0.3.2.

4
00:00:20.700 --> 00:00:29.175
In numbers: 22 signals in total, 10 on iOS and 13 on Android, with debugger attached shared by both.

5
00:00:29.625 --> 00:00:35.175
13 of them are strong evidence, such as an su binary or a Frida agent.

6
00:00:35.625 --> 00:00:41.650
And it makes no network calls, collects no telemetry, and has no runtime dependencies.

7
00:00:43.267 --> 00:00:46.742
Your app runs on devices you do not control.

8
00:00:47.192 --> 00:00:56.092
Attackers use rooted or jailbroken phones, hooking frameworks, debuggers, emulators, and repackaged apps to get around your logic.

9
00:00:56.542 --> 00:01:03.167
This library reports those conditions as typed signals, so your app can decide what to do about them.

10
00:01:04.767 --> 00:01:07.692
The signals fall into 7 categories.

11
00:01:08.142 --> 00:01:14.742
Root has the most, with 6 signals, followed by jailbreak with 4, hooking with 4, tamper with 4.

12
00:01:15.192 --> 00:01:22.767
Emulator, Debugger, and Environment are smaller groups, and some of them are context signals rather than evidence.

13
00:01:24.367 --> 00:01:29.042
The native module runs every check and returns a list of signals.

14
00:01:29.492 --> 00:01:34.142
Signals you chose to ignore move aside and never affect the result.

15
00:01:34.592 --> 00:01:41.767
The policy decides which categories are compromising. By default that is everything except the emulator.

16
00:01:42.217 --> 00:01:49.792
The status is compromised, unknown, or clean. Unknown is never treated as clean, so only clean is safe.

17
00:01:51.400 --> 00:01:53.450
Using it is one call.

18
00:01:53.900 --> 00:02:00.075
You pass options to ignore signals, set the policy, and switch on the opt-in tamper checks.

19
00:02:00.525 --> 00:02:05.700
You get back a status, the signals, the ignored signals, and how long the check took.

20
00:02:06.150 --> 00:02:13.100
In React, the useDeviceIntegrity hook does the same and re-checks when the app returns to the foreground.

21
00:02:14.700 --> 00:02:18.825
Install it with expo install, and add the config plugin.

22
00:02:19.275 --> 00:02:26.800
It needs the New Architecture, iOS 15.1 or later, and Android minSdk 24.

23
00:02:27.250 --> 00:02:31.125
Expo Go is not supported, so use a development build.

24
00:02:32.733 --> 00:02:38.533
A snapshot of popular options, from the README, as of September 2026.

25
00:02:38.983 --> 00:02:46.708
This library focuses on typed, fail-closed integrity signals, including hooking detection on both platforms.

26
00:02:47.158 --> 00:02:52.608
It makes no network calls, while freeRASP sends security telemetry to its vendor.

27
00:02:53.058 --> 00:03:00.433
Pick freeRASP for broad RASP coverage and managed reporting. None of these replace server-side attestation.

28
00:03:02.033 --> 00:03:10.408
Here is the real example app on the iOS Simulator. The status is clean, with a single context signal: simulator.

29
00:03:10.858 --> 00:03:18.533
Now we switch on, treat emulator as compromised. The very same signal now turns the status to compromised.

30
00:03:18.983 --> 00:03:27.208
Opening the protected screen shows what a fail-closed app does: access is blocked, and the screen lists the signal that caused it.

31
00:03:27.658 --> 00:03:34.908
Switch the policy off again and the protected content opens, because the device passes the integrity check.

32
00:03:37.433 --> 00:03:42.533
Here is every signal at a glance, grouped by category and marked by strength.

33
00:03:42.983 --> 00:03:49.808
Each one has its own page in the checks reference, with the mechanism, the threat, and how it is bypassed.

34
00:03:50.258 --> 00:03:53.958
And most categories have a video if you want the detail.

35
00:03:55.567 --> 00:04:04.942
These are client-side risk indicators. Someone who controls the device can evade them with hooking, hiding tools, or rootless jailbreaks.

36
00:04:05.392 --> 00:04:12.042
For high-value flows, confirm on the server with Apple App Attest and the Play Integrity API.

37
00:04:12.492 --> 00:04:17.242
And fail closed: treat only clean as safe, and unknown as not safe.

38
00:04:17.692 --> 00:04:21.867
Detection raises the cost of an attack. It does not end it.

39
00:04:23.467 --> 00:04:27.642
Thanks for watching. The package is on npm and GitHub.

40
00:04:28.092 --> 00:04:34.467
The documentation site has the checks reference, the testing guides, and a video for each category.

41
00:04:34.917 --> 00:04:38.067
Now try the example app on your own device.