Release Notes Mobile Application Shielding for iOS Version 8.0.3 (December 2025)

Due to changes in Usage of the colon in the codesign command line syntax when specifying the path is deprecated. It will not work in a future release and will then be removed. For more information, see also Signing the Application on iOS.

OneSpan Jigsaw encryption is no longer supported for Mach-O Intel binaries. Note that this only applies to Premium Feature users only because Jigsaw is only implemented in OneSpan Code Obfuscation.

Description: False positives could occur if a user backed up a jailbroken device and later restored it on a non-jailbroken device.

Status: This issue has been fixed.

Description: An evaluation version of App Shielding that was specifically configured to allow uploading to TestFlight would set the minimum operating system version to 12, causing an error on app upload.

Status: This issue has been fixed.

Description: An issue occurred with the protection of IPA files that had a __MACOSX metadata folder. Note that an IPA would not normally have this folder unless it was improperly created.

• Improved control flow abstraction for Mach-O binaries to be able to protect the __TEXT,__stubs section.

• Improved protection time performance.

• Improved the validation of integrity checking and checksumming configurations to prevent conflicting configurations.

• Fixed an issue which prevented Mach-O binaries from using the system log after protection.

• Fixed an unexpected termination that sometimes occurred on arm64 binaries.

• Fixed an issue which prevented OneSpan Jigsaw from finding dSYM files when Spotlight was disabled.

For code obfuscation: if you are using OneSpan Jigsaw, you might encounter unexpected terminations or other issues with apps that programmatically read information at the beginning of virtual space, such as the Mach-O header.

For code obfuscation: when  shielding with native obfuscation, ensure that the names of the dSYM zip file package uploaded to the OneSpan Mobile Portal and the name of the dSYM file inside the zip file package are identical. Otherwise, the shielding operation will fail!

For apps that use UISceneDelegate on iOS 13 and later, the on-screen keyboard is not blocked.

If you enable the configuration options Exit On Screen Recording and Exit On Screen Recording URL, and change the App Shielding versions from 7.0.6 or 7.0.6-a to 7.2.1 or vice-versa, your settings will be lost. To ensure the app is exited and the specified web page with an explanation is launched, you need to re-enable the options as required after you changed versions.

Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:

1. It is not longer protected with App Shielding.

2. It is signed with a different developer certificate.

Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.

OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.

Xcode marks the ShieldSDK.xcframework package as not signed or verified and might move it to quarantine mode. If Xcode displays a message like ShieldSDK.xcframework cannot be opened..., follow these steps to resolve it:

1. Select Cancel.

2. Open the macOS System Settings.

3. Navigate to Privacy & Security.

4. Scroll down to the security warning and select Allow Anyway.

This will be fixed as soon as possible.

If your app was compiled with Xcode 26, and the Enable Enhanced Security option was set to Yes, the Shielding Tool will fail to protect the app.

This option is not enabled by default, and a future release of the Shielding Tool will improve the compatibility.