Independent evaluation for mobile protection SDKs.

Find the bypasses in your RASP, anti-tampering or anti-bot SDK before attackers do. Get reproducible proof and hardening guidance.

Discuss your SDK Services for security teams

A bypass affects every app that uses your SDK.

For teams developing protection SDKs for mobile apps.

Your team knows how the SDK works, so they tend to test the attacks it was designed to stop. Attackers do not know the design, and try techniques you may not have considered.

And a bypass rarely affects a single app. If it works against your SDK, it can work against every app that uses it, until you release a fix and your customers update.

What we evaluate.

Depending on your product, the evaluation can cover:

Runtime application self-protection (RASP): detection of hooking, debugging and instrumentation.
Anti-tampering and integrity checks: detection of modified or repackaged apps.
Obfuscation and reverse engineering protections: how hard it is to understand and modify the protected code.
Root, jailbreak and emulator detection: whether these checks can be bypassed.
Bot detection and anti-automation: whether protected flows can still be automated.

We test the SDK in a reference app you provide.

How we work.

Scoping: in a call, we agree what to test. Then we send you a proposal for that work. We agree confidentiality terms before you share builds or documentation.
Evaluation: our specialists attack the SDK as an outside attacker would, using reverse engineering and dynamic analysis with our own tools.
Report and review: we send the report and go through each bypass and its root cause with your engineers.
Retest: once you have fixed the bypasses, we check the fixes in the new build.

What you receive.

Confirmed bypasses

Each bypass with steps to reproduce it and a proof of concept your engineers can run.

Root causes

Why each bypass works, so your engineers can fix the cause and not just the symptom.

Hardening guidance

Practical recommendations to make each detection harder to bypass.

Test coverage

What we tested, as agreed in the proposal. Where we found no bypass, we describe what we tried.

Why vulnit for protection SDKs.

We help define how protections are tested

Our team contributes to MASVS-RESILIENCE, the part of OWASP MAS that covers app protections. We know how protections like yours are tested, and how they are bypassed. OWASP recognized this work by naming vulnit an OWASP MAS Advocate.

An independent view

We do not sell app protections. We look at your SDK as an outside attacker would, without your team's assumptions.

Reverse engineering is our daily work

We analyze protected apps every day in our projects and research, and build the tools we use to do it.

Meet the team

Protection SDK evaluation FAQs.

How is this different from RASP validation?

RASP validation tests the protections inside one specific app, for the team that integrates them. This service evaluates the SDK itself, for the team that builds it.

Do you test both Android and iOS?

Yes. We cover the platforms your SDK supports, and agree the builds, devices and test conditions for each one.

Do you need source code?

No. The evaluation is black-box: we start with the same knowledge an attacker would have.

How do you handle confidentiality?

We agree confidentiality terms, such as an NDA, before you share builds or documentation. This includes how we handle findings about your product.

How are price and timing agreed?

It depends on the platforms, protections and configurations in scope and the attacker objectives. You receive a proposal with the scope, price and schedule before testing starts.

Is retesting included?

Retesting is quoted separately at a reduced rate. We agree which fixes and builds to check again.

Want an independent view of your SDK?

Tell us about your SDK. We reply within one business day to arrange a scoping call.

Discuss your SDK