Skip to main content

Why Safe to Run?

caution

No solution to tamper detection is foolproof, if someone is able to decompile your application and push it onto an unsuspecting device, it is possible remove the functionality of safe to run.

This just makes it that much harder...

Overview​

Safe to run has been developed in order to simplify development of secure android applications. Safe to run has two primary capabilities:

  • Checking if the device is safe to run
  • Providing a capability to verify intents, URLs and other types of vulnerable items

Motivation​

In particular the goal of the project is to provide a simple, configurable way for app developers to define when an app should or should not run and a simple way of calling that check.

Input verification​

Input verification is intended to ensure that URLs are safe to load into webviews, or to make API calls or that intents coming from external sources match some predefined conditions. Check the documentation under 'input verification' to get started

Checks​

Safe to run consists of a number of 'checks' which are detailed in the documentation. The purpose of these checks is to ensure that the app is 'safe to run' i.e. it meets the pre-conditions you have set.

Following are a list of things that Safe to run can help protect against and the checks that can help with them

Hardening against de & recompilationHarden against reverse engineers and pentestersHarden against insecure devices
Signature check[x][x]
Root detection[x][x]
OS Check[x]
Blacklisting apps[x]
Debug check[x]
Install origin[x]
Emulator check[x][x]