---
title: "How Mobile App Security Works"
description: "Explains what sealing does to your app, the layers of protection it adds, how the app responds to threats at runtime, and where detection data goes."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

DoveRunner Mobile App Security protects a mobile app at runtime (RASP) without changes to its source code. This page explains the model behind it: what sealing does, which protections it adds, how a protected app responds when it detects a threat, and where that information goes. For the steps, see [Android App Sealing](https://docs.doverunner.com/mobile-app-security/android/android-sealing/) and [iOS App Security](https://docs.doverunner.com/mobile-app-security/ios/).

## Sealing

**Sealing** adds DoveRunner's security module to your app. On Android, you upload a compiled APK or AAB to the Developer Console. On iOS there are two paths: upload a compiled IPA, or integrate the DoveRunner SDK into your build so every build is protected. [Choosing an approach](https://docs.doverunner.com/mobile-app-security/ios/#choosing-an-approach) compares the two.

Because sealing a compiled app modifies its executable, the app's original code signature is no longer valid. A sealed APK, AAB or IPA has to be signed again before it can be installed or submitted to a store. DoveRunner can sign it for you with the keystore or certificate you register, or you can download it unsigned and sign it yourself. SDK sealing on iOS is the exception: protection is applied during your build, so your build signs the app as usual.

## Layers of protection

A sealed app carries two kinds of protection.

- **Always-on protections** are applied to every sealed app and cannot be turned off: code encryption, anti-debugging and runtime-attack defenses (for example debugger attach blocking and Frida detection), anti-tampering integrity checks, and detection of virtual environments and cheat tools.
- **Configurable detections** are chosen when you seal: how the app reacts to a compromised or monitored device (rooting or jailbreak, emulators, developer options), to malicious tools installed on the device, and to advanced threats such as screen capture and overlay windows.

The exact lists differ by platform and sealing version. See [Always-On Protections for Android](https://docs.doverunner.com/mobile-app-security/android/android-sealing-options/#always-on-protections) and [for iOS](https://docs.doverunner.com/mobile-app-security/ios/ipa-sealing/#always-on-protections), and the wizard steps that follow each.

## Responding to threats

For each configurable detection you choose what the app does when it finds the threat:

- **Block** terminates the app.
- **Allow** does not respond.
- **Monitor** logs the threat and keeps the app running.
- **Callback** logs the threat, keeps the app running and notifies your app, so your own code decides what happens next, for example ending the user session or showing a warning.

Monitor and Callback are available on Android from sealing version 3.3.0.0, for most detections. See [Threat Response Actions](https://docs.doverunner.com/mobile-app-security/android/android-sealing-options/#threat-response-actions) for which detections support them, and [Threat Detection Callback Integration](https://docs.doverunner.com/mobile-app-security/android/android-threat-callback/) for handling callbacks in your app.

## Where detection data goes

When a sealed app runs, it sends the threats it detects to DoveRunner in real time. They appear in the Developer Console under **Analytics**: hacking detections, active devices and real-time threat analysis. You can also set up threat alerts, so DoveRunner notifies your team by email or through a [webhook](https://docs.doverunner.com/mobile-app-security/console/settings/manage-webhook/) when attack volume against an app changes unusually.

- [Dashboard Guide](https://docs.doverunner.com/mobile-app-security/console/dashboard/dashboard-guide/)
- [Real-Time Threat Analysis](https://docs.doverunner.com/mobile-app-security/console/dashboard/real-time-threat-analysis/)
- [Manage Threat Alerts](https://docs.doverunner.com/mobile-app-security/console/settings/manage-threat-alerts/)