feat(security): add tamper and jailbreak detection with graceful degradation (#1772)

[amankoli09]

Summary

Resolves #1772 by implementing comprehensive tamper, root, and jailbreak detection for mobile clients (Android & iOS) with an accessible graceful degradation model and formal security policy documentation.

1. Detection Engine (src/services/auth/deviceAttestationService.ts)

• Android Root Detection:
  • Scans known su binaries and root paths (/system/xbin/su, /sbin/su, /data/local/xbin/su, etc.).
  • Detects Magisk indicators (/sbin/.magisk, /data/adb/magisk, etc.).
  • Detects root manager packages (com.topjohnwu.magisk, eu.chainfire.supersu, etc.).
  • Detects untrusted third-party ROMs via Build.TAGS containing test-keys.
  • Flags insecure system properties (ro.debuggable=1, ro.secure=0).
• iOS Jailbreak Detection:
  • Scans known jailbreak files and directories (/Applications/Cydia.app, /Library/MobileSubstrate/MobileSubstrate.dylib, /bin/bash, etc.).
  • Verifies jailbreak URL schemes (cydia://, sileo://, zbra://, etc.).
  • Detects sandbox escape via restricted path write probes (/private/).
• Anti-Tampering & Hooking Detection:
  • Detects Frida dynamic instrumentation globals (globalThis.frida, Process.arch, Module).
  • Detects Xposed framework injections (XposedBridge).
  • Checks JavaScript native prototype integrity (Function.prototype.toString).
  • Detects debugger attachment in production mode.
• Emulator / Simulator Detection:
  • Identifies Android SDK emulator, Goldfish, and Ranchu hardware.
  • Identifies iOS Simulator.

2. Graceful Degradation Model

Instead of hard crashing or locking users out of safe functionality:

• Safe features remain available: Reading subscriptions, browsing analytics, organizing categories, documentation, and app settings (VIEW_SUBSCRIPTIONS, VIEW_ANALYTICS, MANAGE_CATEGORIES, CHANGE_SETTINGS).
• Sensitive financial operations are restricted: Web3/crypto transaction signing, credit card checkout, private key exports, and biometric authentication (EXECUTE_PAYMENT, SIGN_TRANSACTION, EXPORT_PRIVATE_KEYS, BIOMETRIC_AUTH, EXPORT_SENSITIVE_DATA).
• Exposes isOperationAllowed(op) and throwing assertion assertOperationAllowed(op).
• Updates BiometricGate to bypass/restrict local biometrics safely when integrity is compromised.

3. User Experience & Accessibility

• Created DeviceIntegrityBanner (src/components/security/DeviceIntegrityBanner.tsx):
  • Accessible banner (accessibilityRole="alert", high-contrast WCAG 2.1 AA styling).
  • Displays clear, non-technical explanation with optional collapsible detected signals for transparency.
  • Dismissable to continue viewing subscriptions in degraded mode.
  • Rendered prominently in HomeScreen.

4. Policy Documentation

• Created docs/DEVICE_INTEGRITY_POLICY.md specifying threat vectors, detection signals, risk classification matrix (Low, Medium, High, Critical), permitted vs restricted operations, and compliance references (OWASP MASVS, PCI DSS 6.5).
• Linked policy in docs/security.md.

Verification & Tests

• Unit test suite: src/services/auth/__tests__/deviceAttestationService.test.ts (covers clean devices, Android root, iOS jailbreak, Frida tampering, emulator detection, graceful degradation matrix, cache lifecycle).
• Hook test suite: src/hooks/__tests__/useDeviceIntegrity.test.ts (covers cache initialization, fresh probes, banner dismissal, and force recheck).
• Component test suite: src/components/security/__tests__/DeviceIntegrityBanner.test.tsx (covers rendering conditions, accessibility attributes, details expand/collapse, dismiss actions).
• Syntax validated with node --experimental-strip-types --check.
• Core smoke tests validated (scripts/validate-autoscaling.js, scripts/anonymize-test-data.js).

Closes #1772

[drips-wave]

@amankoli09 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits