Root / Jailbreak Detection

Instructions

Root and jailbreak detection are signals, not security controls. A rooted device can hide itself from any detection you write. Design for that reality.

1. What a Rooted / Jailbroken Device Actually Means

• Platform sandbox is no longer a trust boundary for your app.
• Keystore / Keychain material is still protected if it is hardware-backed — root can't extract from StrongBox / Secure Enclave.
• TLS pinning can be bypassed (user CA installed into system store, Frida unpinning, LSPosed modules).
• Screen recorders, input injectors, and clipboard snoopers are trivial.

You may still want to run on these devices (your users include pentesters, tinkerers, and kids with unlocked bootloaders) — but with a higher risk score.

2. Android Signals (Combine Several)