Common questions
FAQ
Short answers about what the SDK collects, what it deliberately leaves to your application, and how to evaluate it safely.
Product boundary
Does the SDK return a fraud or risk score?
No. It returns typed raw observations and independent probe outcomes. Your trusted backend owns derived features, scoring, policy, and review.
Does the SDK upload collected data?
No. There is no built-in transport or vendor endpoint. Your app decides whether to send an event through its existing authenticated API.
Does it create a persistent device ID?
No. The library does not create a cross-reinstall identifier. Avoid combining high-entropy fields solely to reconstruct one.
Does it replace Play Integrity or App Attest?
No. Platform attestation supplies server-verifiable evidence. Local device observations provide different context and should be combined with server-side controls.
Platforms and builds
Which React Native versions are supported?
React Native 0.76 and newer with the New Architecture. The repository CI compatibility matrix covers selected supported releases.
Does it work in Expo Go?
No. It includes native Android and iOS code, so Expo projects need a prebuild or custom development build.
Why can fields be missing?
Availability varies by platform, OS, hardware, permission state, configuration, and probe outcome. Missing, skipped, timeout, and false are different states.
Are Android and iOS results identical?
No. The public contract is aligned, but OS APIs and security models differ. Platform-specific fields and explicit stubs are documented in the catalog.
Privacy and permissions
Does the SDK request permissions?
No. Permission-sensitive probes use only access already granted to the host app. They do not display permission prompts.
Can location be collected?
The geolocation probe can read permission state and an already-available last-known location. It never starts active updates or asks for permission.
Does it scan all installed Android apps?
No. The package uses a finite audited known-app list and does not request broad QUERY_ALL_PACKAGES visibility.
How should accessibility observations be used?
With care. Assistive technology is legitimate and may relate to disability. Accessibility state must never be treated as fraud by itself.
Production use
Which probes should we enable first?
Start from a documented use case, then choose the smallest field set. Keep transaction safety, benchmarks, and uncalibrated active tests disabled until representative physical-device validation.
Can one signal block a transaction?
No. Never block or decline based on one signal. Corroborate evidence, calibrate against labels, monitor false positives, and provide a recovery path.
How do we report a bypass or security issue?
Use the repository security policy and private vulnerability reporting when available. Do not publish an active bypass in a public issue before maintainers can assess it.
Can the maintainer help with integration?
Yes. The maintainer is open to React Native architecture, native SDK integration, mobile security, performance, CI/CD, and product-development collaboration through GitHub.