Release Notes Mobile Application Shielding for iOS Version 8.0.2 (December 2025)

With this version, we are introducing Premium Features and launch OneSpan Code Obfuscation, as an extension to OneSpan Mobile Application Shielding. Use OneSpan Code Obfuscation to prevent reverse engineering and unauthorized modification of your app.

With its embedded Jigsaw engine, it protects JavaScript code in hybrid mobile applications with layered defenses, and native iOS executables and frameworks. For JavaScript code protection, OneSpan Code Obfuscation combines obfuscation with other mechanisms. For native code obfuscation, advanced code protection is embedded directly into your binaries. The Jigsaw engine also provides strong binding to the App Shielding library, protecting the whole application from runtime attacks. Because the engine works directly on the machine code in the library, there are no limitations on the development tools that you can use to create your native components.

This is a premium feature. To implement it in your integration, you need a license for OneSpan Code Obfuscation. For information how to obtain this, please contact your sales representative. For more information about the feature, see the product documentation (valid license required to access the documents).

With a valid license you can enable this feature in the configuration for your shielding project in the OneSpan Mobile Portal.  

When shielding with native obfuscation, ensure that the names of the dSYM zip file package uploaded to the OneSpan Mobile Portal and the name of the dSYM file inside the zip file package are identical. Otherwise, the shielding operation will fail!

For the introduction of the OneSpan Code Obfuscation feature, Native and Javascript libraries have been added to the iOS sample app delivered with the product package.

Description: A false positive could occur if a user backed up a jailbroken device and later restored it on a non-jailbroken device.

Status: This issue has been fixed.

Blocking external screens (e.g. AirPlay) is currently not working for apps that use UISceneDelegate on iOS 13 and later. However, the on-screen keyboard is not blocked.

If you enable the configuration options Exit On Screen Recording and Exit On Screen Recording URL, and change the App Shielding versions from 7.0.6 or 7.0.6-a to 7.2.1 or vice-versa, your settings will be lost. To ensure the app is exited and the specified web page with an explanation is launched, you need to re-enable the options as required after you changed versions.

Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:

1. It is not longer protected with App Shielding.

2. It is signed with a different developer certificate.

Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.

OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.

Xcode marks the ShieldSDK.xcframework package as not signed or verified and might move it to quarantine mode. If Xcode displays a message like ShieldSDK.xcframework cannot be opened..., follow these steps to resolve it:

1. Select Cancel.

2. Open the macOS System Settings.

3. Navigate to Privacy & Security.

4. Scroll down to the security warning and select Allow Anyway.

This will be fixed as soon as possible.

If your app was compiled with Xcode 26, and the Enable Enhanced Security option was set to Yes, the Shielding Tool will fail to protect the app.

This option is not enabled by default, and a future release of the Shielding Tool will improve the compatibility.