Release Notes Mobile Application Shielding for iOS Version 8.1.3 (May 2026)

The current Apple TestFlight certificate will expire on 2026-08-12 and Apple has switched to a new certificate. We have updated the TestFlight certificate on the OneSpan Mobile Portal to ensure compatibility with application certificate validation checks. The new certificate will be applied automatically during shielding. You can also retrieve the certificate from this Knowledgebase Article on our Customer Portal and add as Application signer certificate > Custom certificate in your App Shielding configuration.

Shielded apps that are already on the App Store or builds that are already on TestFlight are not impacted.

Description: For the Exit URL Launching feature, the %REASON% variable used as placeholder when the application is shut down and a web browser is launched returned the hexadecimal value 06 as response.

Status: This issue has been fixed. The relevant plugin has been updated, and now the decimal value 6 is returned as response.

Description: An issue caused the application to become unresponsive if a network connection could not be established while fetching an updatable configuration.

Status: This issue has been fixed.

For the Exit URL Launching feature, the URL used to launch the web browser can use variable placeholders. App Shielding substitutes these placeholders to provide the relevant information inside the URL itself. For the Exit On Screen Recording URL option, the %VERSION% placeholder is not correctly replaced because the plugin cannot know the App Shielding version in the app.

For Code Obfuscation: if you are using OneSpan Jigsaw, you might encounter unexpected terminations or other issues with apps that programmatically read information at the beginning of virtual space, such as the Mach-O header.

For Code Obfuscation: when shielding with native obfuscation, ensure that the names of the dSYM zip file package uploaded to the OneSpan Mobile Portal and the name of the dSYM file inside the zip file package are identical. Otherwise, the shielding operation will fail!

For apps that use UISceneDelegate on iOS 13 and later, the on-screen keyboard is not blocked.

If you enable the configuration options Exit On Screen Recording and Exit On Screen Recording URL, and change the App Shielding versions from 7.0.6 or 7.0.6-a to 7.2.1 or vice-versa, your settings will be lost. To ensure the app is exited and the specified web page with an explanation is launched, you need to re-enable the options as required after you changed versions.

Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:

1. It is not longer protected with App Shielding.

2. It is signed with a different developer certificate.

Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.

OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.

Xcode marks the ShieldSDK.xcframework package as not signed or verified and might move it to quarantine mode. If Xcode displays a message like ShieldSDK.xcframework cannot be opened..., follow these steps to resolve it:

1. Select Cancel.

2. Open the macOS System Settings.

3. Navigate to Privacy & Security.

4. Scroll down to the security warning and select Allow Anyway.

This will be fixed as soon as possible.

If your app was compiled with Xcode 26, and the Enable Enhanced Security option was set to Yes, the Shielding Tool will fail to protect the app.

This option is not enabled by default, and a future release of the Shielding Tool will improve the compatibility.