Security
The Unveily SDK and platform are built with security as a default. The protections below are applied automatically — no additional configuration required.
SDK Security
License Key Encrypted Storage
On first launch, the license key is automatically migrated to hardware-backed secure storage. Android uses AndroidKeyStore-backed EncryptedSharedPreferences (AES256-GCM); iOS uses the iOS Keychain. On subsequent launches, the key is loaded directly from encrypted storage — never from the file system.
SSL Certificate Pinning
SHA-256 certificate pins are applied to all internal SDK API communication. Pin values are encoded in the compiled binary using a distinct key per field, so they are never visible as plain strings.
Root / Jailbreak Detection
SDK execution is blocked on rooted (Android) or jailbroken (iOS) devices. Controlled via security.rootDetectionEnabled in config.json.
Screenshot and Background Protection
Screen capture and recording are blocked within the app. Content is blurred in the app switcher so it is not visible in previews. Recommended for finance, healthcare, and payment apps.
App Signature Verification
Licenses are validated against the package name and signing certificate hash. Repackaged or signature-tampered apps will not pass verification.
API and Infrastructure Security
| Item | Details |
|---|---|
| Authentication | JWT with short expiration |
| Secret management | GCP Secret Manager — no plaintext secrets in source code |
| Transport | HTTPS enforced on all endpoints |
| Rate limiting | Applied to authentication endpoints |
| Servers | GCP Cloud Run — no persistent server attack surface |
| Database | Cloud SQL with private IP (no public internet exposure) |
| File delivery | GCS private bucket, Signed URLs (15-minute expiration) |
Dependency Vulnerability Management
All repositories are automatically scanned weekly for dependency vulnerabilities via GitHub Dependabot. Critical CVEs are patched within 72 hours of public disclosure. We also run a security review around major releases and publish the results below.
Security review log
- 2026-08-08 — Reviewed all .NET and npm dependencies. Found a transitive Microsoft.OpenApi vulnerability (High, GHSA-v5pm-xwqc-g5wc) and patched it to 2.7.5.0 known vulnerabilities after the review.
- 2026-06-13 — Reviewed all .NET and npm dependencies. 0 known vulnerabilities.
Reporting a Vulnerability
If you discover a security vulnerability, please report it privately rather than opening a public issue.
We will acknowledge your report within 48 hours and provide a resolution timeline within 7 business days. We will not take legal action against researchers who report vulnerabilities in good faith.