Security Scanning

Security Scanning

Get Current Scan Results

// Returns: Future<String?>
// The most recent security scan result as a string
// Contains detailed information about the current security state of the device/app
// Returns null if no scan has been performed or SDK is not initialized
final scanResult = await AlphynSdk.getScanResult();
if (scanResult != null) {
  print('Scan Result: $scanResult');
} else {
  print('No scan result available');
}

// Example output: 'SIMULATOR_RUNTIME'
// or 'FRIDA_DETECTED'
// or null if no scan performed

Purpose: Retrieves the most current security scan results. This provides real-time information about:

• Current security threats detected
• Device security posture
• Active security violations
• Overall security status

Use this to make immediate security decisions (e.g., blocking features, logging out users).

Get Security Rejection Reasons

// Returns: Future<List<String>>
// A list of specific security issues that triggered rejection or warnings
// Each string describes a distinct security concern detected
// getRejectReasons() returns a newline-separated string; split it into a list
final rejectReasonsRaw = await AlphynSdk.getRejectReasons();
final rejectReasons = rejectReasonsRaw.split('\n').where((line) => line.trim().isNotEmpty).toList();
print('Rejection Reasons: $rejectReasons');

// Example output:
// [
//   'DETECTION: COMMON_SUSPICIOUS_PATH Common suspicious file path accessible',
//   'DETECTION: SIMULATOR_ENVIRONMENT Simulator environment detected',
//   'DETECTION: SIMULATOR_RUNTIME Simulator runtime detected',
//   'DETECTION: DEBUGGER_SYSTEM_CHECK Debugger detected (system check)',
//   'DETECTION: FRIDA_DETECTED Frida traces detected',
//   'DETECTION: VPN_IN_USE VPN in use'
// ]

for (var reason in rejectReasons) {
  print('Security Issue: $reason');

  // Parse detection type and description
  if (reason.startsWith('DETECTION:')) {
    final parts = reason.substring(11).split(' ');
    final detectionType = parts.first;
    print('  Type: $detectionType');
  }
}

Purpose: Returns a detailed list of all security violations or concerns detected during scanning. Each reason represents:

• A specific security threat or risk factor
• The type of violation (e.g., jailbreak, debugger, emulator)
• Issues that may require app restrictions or user warnings

Use this to:

• Display specific security warnings to users
• Log detailed security events
• Implement granular security policies based on threat types

Get Last Scan Date

// Returns: Future<DateTime?>
// The timestamp when the last security scan was completed
// Returns null if no scan has been performed yet
final lastScanDate = await AlphynSdk.getLastScanDate();
if (lastScanDate != null) {
  print('Last Scan: ${lastScanDate.toIso8601String()}');
  // Output: Last Scan: 2025-11-20T11:21:28.000Z

  print('Time since last scan: ${DateTime.now().difference(lastScanDate)}');
  // Output: Time since last scan: 0:00:02.456789
} else {
  print('No scan performed yet');
}

Purpose: Provides the exact timestamp of the last completed security scan. Useful for:

• Determining scan freshness
• Calculating time intervals between scans
• Triggering manual scans if too much time has passed
• Audit logging and compliance reporting

Verify High-Risk Actions

signAction signs with a hardware-backed key that belongs to one enrolled user, so enrollForMfa(userId) must have run once on this device first, and userId below is your own identifier for the logged-in user. The PIN is optional. See MFA Transaction Signing for the full flow.

// Returns: Future<ActionVerificationResult>
// Verifies a high-risk action with the Alphyn backend
// Used for sensitive operations like payments, data transfers, etc.

final result = await AlphynSdk.signAction(
  userId: userId,
  actionLabel: 'payment_transfer',
  context: {
    'amount': '1000.00',
    'currency': 'USD',
    'recipient': '[email protected]',
    'timestamp': DateTime.now().toIso8601String(),
  },
);

if (result.success) {
  print('✅ Action verified successfully');
  print('Token: ${result.token}');
  print('Expires at: ${result.expiresAtEpochMs != null ? DateTime.fromMillisecondsSinceEpoch(result.expiresAtEpochMs!) : 'N/A'}');

  // Proceed with the high-risk action using the verification token
  proceedWithAction(result.token!);
} else {
  print('❌ Action verification failed');
  print('Error Code: ${result.errorCode}');
  print('Error Message: ${result.errorMessage}');

  // Block the action or show error to user
  showErrorToUser(result.errorMessage ?? 'Verification failed');
}

Purpose: Verifies high-risk actions with the Alphyn backend before execution. This provides an additional layer of security for sensitive operations by:

• Validating the action context with the backend
• Receiving a verification token for the action
• Detecting suspicious patterns or unauthorized attempts
• Enabling action-level security policies

Parameters:

• actionLabel (required): A string identifier for the action type (e.g., 'payment_transfer', 'sensitive_data_access')
• context (required): A map containing contextual information about the action. This is forwarded to the backend for verification.

Returns: Future<ActionVerificationResult> with the following properties:

• success (bool): Whether the verification was successful
• token (String?): Verification token if successful (use this to proceed with the action)
• expiresAtEpochMs (int?): Token expiration timestamp in milliseconds since epoch
• errorCode (String?): Error code if verification failed
• errorMessage (String?): Human-readable error message if verification failed

Use Cases:

• Payment transactions
• Sensitive data transfers
• Administrative operations
• Account modifications
• Any operation requiring additional verification

Example: Payment Verification

Future<void> processPayment({
  required double amount,
  required String recipient,
}) async {
  // Verify the payment action before processing
  final verification = await AlphynSdk.signAction(
    userId: userId,
    actionLabel: 'payment_transfer',
    context: {
      'amount': amount.toString(),
      'currency': 'USD',
      'recipient': recipient,
      'timestamp': DateTime.now().toIso8601String(),
      'user_id': currentUserId,
    },
  );

  if (!verification.success) {
    throw PaymentException(
      'Payment verification failed: ${verification.errorMessage}',
    );
  }

  // Use the verification token when processing the payment
  await paymentService.transfer(
    amount: amount,
    recipient: recipient,
    verificationToken: verification.token!,
  );
}