cordova-plugin-ios-advanced-security

Advanced iOS security detection for Cordova / Ionic apps.

This plugin provides heuristic, App-Store-safe checks for common attack or inspection scenarios:

• Jailbreak detection
• Debugger attachment detection
• Developer mode heuristics
• Reverse-engineering tooling detection (Frida, Cycript, Hopper, IDA, etc.)
• A combined security score (0–100)

Note: Some checks are heuristic and cannot be 100% definitive on iOS due to sandboxing and the absence of private APIs. Use this plugin as part of a layered mobile security approach (hardening, server-side verification, certificate pinning, secure storage).

Features

• Cordova-compatible JavaScript API (IOSAdvancedSecurity.*) ready for Ionic apps
• Asynchronous callbacks for all checks
• Detailed report object with per-check details and a numeric security score
• MIT licensed — publishable on npm

Installation

From the app project root:

cordova plugin add https://github.com/yourusername/cordova-plugin-ios-advanced-security.git
# or if published to npm:
cordova plugin add cordova-plugin-ios-advanced-security

Then in your JavaScript:

document.addEventListener('deviceready', function() {
  IOSAdvancedSecurity.getSecurityReport(function(report) {
    console.log('Security report', report);
  }, function(err) {
    console.error('Security check failed', err);
  });
});

Methods

• getSecurityReport(success, error)
  Returns an object:

  {
    isJailbroken: Boolean,
    isDebuggerAttached: Boolean,
    isDeveloperMode: Boolean,
    reverseEngineeringDetected: Boolean,
    details: {
      jailbreakDetails: { ... },
      debuggerDetails: { ... },
      environmentDetails: { detected: Boolean, foundFiles: [...], loadedImages: [...] }
    },
    score: Number // 0-100, higher = more secure
  }

• isJailbroken(success, error) → Boolean

• isDebuggerAttached(success, error) → Boolean

• isDeveloperModeEnabled(success, error) → Boolean (heuristic)

• detectReverseEngineeringTools(success, error) → details dictionary

• getSecurityScore(success, error) → Integer 0–100

How scoring works

A simple weighted approach is used (tune weights as needed):

• Jailbreak detected: -50
• Debugger attached: -30
• Reverse tools detected: -25
• Developer mode heuristics: -15

Base = 100, clamped to [0,100].

Security & Best Practices

• This plugin provides helpful detection signals — but it should not be the only security control.
• Combine with:
  • Server-side checks for suspicious client behavior
  • Certificate pinning for transport security
  • Sensitive data kept out of device storage or protected by Keychain & secure enclaves
  • App hardening (obfuscation, tamper-detection, runtime protections)
• Avoid relying on any single detection; heuristics can produce false positives/negatives.

Contributing

Contributions are welcome. If you add additional checks, please avoid private APIs (they will break App Store review).

License

MIT — see the LICENSE file.