---
title: "Apply DoveRunner Mobile App Security"
description: "Learn how to configure sealing options and apply DoveRunner Mobile App Security protection to your Android app."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

DoveRunner Mobile App Security provides self-protection features — code obfuscation, integrity protection, environment detection, and threat tool detection — without any code changes.

Before you start, have the following ready:
- **Framework** — The framework used to build the app. For hybrid frameworks like React Native, know which version was used.
- **KeyStore info** — Required if you want DoveRunner Mobile App Security to sign the sealed app on your behalf before uploading to the Play Store.

## Sealing an App

Sealing takes three steps:
1. Upload your APK or AAB file.
2. Configure security options across the steps of the Developer Console wizard.
3. Download the sealed app — signed with your keystore, or unsigned for manual signing with apksigner.

Once sealing completes, a download prompt appears. You can also download sealed apps later from [Historical Information](https://docs.doverunner.com/mobile-app-security/android/android-history/).

The wizard has up to six steps, shown down the left side of the page:

| Step | Name | What it covers |
| :--- | :--- | :------------- |
| 1 | **Upload File** | Upload the APK or AAB, and review the always-on protections |
| 2 | **Basic Configuration** | Framework, sealing version, sealing mode, native and Dex code protection |
| 3 | **Environment Detection** | How the app reacts to a compromised or monitored device environment |
| 4 | **Tool & Package Detection** | How the app reacts to malicious tools installed on the device |
| 5 | **Advanced Detection** | Screen capture, overlay windows, OTA updates, Hardware Key Attestation, threat response messages |
| 6 | **Access Signals** | Applies the app's Access Signals policy at seal time. Shown only when the Access Signals add-on is active for your account. |

While you configure the wizard, the right-hand panel lists the **Security settings to be applied** with your current choices. Once you upload a file, it also shows a **Preset** selector, so you can apply a saved sealing preset instead of setting every option by hand. When Access Signals is enabled, the panel also shows an **Access coverage** indicator.

**Note:** 
Some steps and options appear only when the feature is enabled for your account, or when you select a sealing version that supports it. These are marked in the tables in [Android Sealing Options](https://docs.doverunner.com/mobile-app-security/android/android-sealing-options/). If an option you need is not shown in your Developer Console, contact the [Help Center](https://support.doverunner.com).


---

## Sealing options

The always-on protections, the threat response actions and every option in wizard steps 2–6 are described in [Android Sealing Options](https://docs.doverunner.com/mobile-app-security/android/android-sealing-options/).

---

## Security Guide

### Before Sealing

**ProGuard/R8 configuration**

If you use Dex Protection, your ProGuard/R8 setup must preserve your business package structure so DoveRunner can correctly identify and obfuscate your code. See the [ProGuard Setup Guide](https://docs.doverunner.com/mobile-app-security/android/android-proguard-guide/) for the required rules and what to avoid.

**Other requirements**

- Firebase Crashlytics must retain its original package name — do not obfuscate it.
- The following class must not be obfuscated (required for React Native version detection):
  ```
  com/facebook/react/modules/systeminfo/ReactNativeVersion.java
  ```

### After Sealing

The sealed app must be signed before it can be installed or submitted to the Play Store — the original certificate is invalidated during the sealing process.

**Option 1 — Sign via Developer Console (recommended)**

Register your keystore in advance via [Manage KeyStore](https://docs.doverunner.com/mobile-app-security/android/android-manage-keystore/) in the Developer Console. When downloading a sealed build, the console will sign it automatically using the registered keystore. No manual steps required.

**Option 2 — Sign manually**

If you are not using the console's signing feature, sign the output file manually after download:

| Format | Tool | Command |
| :----- | :--- | :------ |
| APK | apksigner | `apksigner sign --ks your.keystore your-app.apk` |
| AAB | jarsigner | `jarsigner -keystore your.keystore your-app.aab alias` |