Platform Security Practices

At a Glance

The Unveily SDK and platform are designed with security as a default. The protections below are applied automatically — no additional configuration required.

SDK Security (Android & iOS)

License Key Encrypted Storage

On first launch, the license key is automatically migrated to hardware-backed secure storage.

Platform	Storage
Android	AndroidKeyStore-backed EncryptedSharedPreferences (AES256-GCM)
iOS	iOS Keychain (kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)

On subsequent launches, the key is loaded directly from encrypted storage — never from the file system.

SSL Certificate Pinning + XOR Obfuscation

SHA-256 certificate pins are applied to all internal SDK API communication. Pin values are encoded in the compiled binary using a distinct XOR key per field, so they are never visible as plain strings.

Host name, primary pin, and backup pin are each encoded with a different key
Exposure of a single field via binary analysis does not compromise the others

Root / Jailbreak Detection

SDK execution is blocked on rooted (Android) or jailbroken (iOS) devices.

assets/config.json

{
  "security": {
    "rootDetectionEnabled": true
  }
}

Screenshot and Background Protection

Screenshot blocking: Prevents screen capture and screen recording within the app
Background blur: Blurs content in the app switcher so it is not visible in previews

assets/config.json

{
  "security": {
    "screenshotProtectionEnabled": true,
    "backgroundProtectionEnabled": true
  }
}

Recommended for finance, healthcare, and payment apps.

App Signature Verification

Licenses are validated against the package name and signing certificate hash. Repackaged or tampered apps will not pass verification.

API Security

Item	Approach
Authentication	JWT with short expiration
Secret management	GCP Secret Manager — no plaintext secrets in source code or environment variables
Transport	HTTPS enforced on all endpoints
Rate limiting	Applied to authentication endpoints

Infrastructure

Item	Configuration
Servers	GCP Cloud Run — no persistent server attack surface
Database	Cloud SQL with private IP (no public internet exposure)
File delivery	GCS private bucket, Signed URLs (15-minute expiration)
Containers	Artifact Registry (no public Docker Hub)

Dependency Vulnerability Management

All repositories are automatically scanned weekly for dependency vulnerabilities via GitHub Dependabot.

Repository	Coverage
ActuallyWorks.Platform	NuGet (API), npm (Web, BFF)
HybridApp Android SDK	Gradle
HybridApp iOS SDK	Swift Package Manager

Critical CVEs patched within 72 hours of disclosure
Automated scan every Monday at 09:00 KST

Reporting a Vulnerability

If you discover a security vulnerability, please report it privately rather than opening a public issue.

[email protected]

We will acknowledge your report within 48 hours and provide a resolution timeline within 7 business days. We will not take legal action against researchers who report vulnerabilities in good faith.