skills.rest
ronjunevaldoz
ronjunevaldozCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

kmp-security

Implements certificate pinning, root detection, and encrypted storage for Kotlin Multiplatform apps.

2|Updated Jun 6, 2026
Search Tags:#kotlin multiplatform#certificate pinning#encrypted storage#root detection#freerasp#owasp mobile#ios binary stripping
One-click install
npx skills add https://github.com/ronjunevaldoz/kmp-agent-skills --skill kmp-security-ronjunevaldoz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kmp-security
Source: https://github.com/ronjunevaldoz/kmp-agent-skills/tree/main/skills/kmp-security
Command: npx skills add https://github.com/ronjunevaldoz/kmp-agent-skills --skill kmp-security-ronjunevaldoz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Kotlin Multiplatform developers lack a single, verified guide for mobile security beyond Android-only R8 obfuscation — certificate pinning has no native cross-platform Ktor support, root/jailbreak detection is easy to hand-roll badly, and credentials often end up in plain SharedPreferences or NSUserDefaults. ## Core Features & Use Cases - Certificate/SSL Pinning: expect/actual implementation using OkHttp's CertificatePinner on Android and an NSURLSessionDelegate challenge handler on iOS, with a broken-pin-first testing technique. - Root/Jailbreak/Tamper Detection: Integrates freeRASP's dedicated KMP variant to detect rooting, Frida/Xposed hooking, repackaging, and debuggers from one shared codebase. - Encrypted Local Storage: Uses KSafe for encryption-on-by-default storage with Android Keystore and iOS Keychain backing, plus WARN/BLOCK security policies. - Use Case: A fintech KMP app needs to reject MITM proxies, block rooted devices from accessing tokens, and strip symbols from its release iOS framework — this Skill provides the verified library coordinates, code, and OWASP Mobile Top 10 2024 coverage map for all of it. ## Quick Start Ask the agent to add certificate pinning and root detection to your KMP app's network layer and app entry point.

Frequently Asked Questions about kmp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement certificate pinning in Kotlin Multiplatform with Ktor?▼

Certificate pinning in Ktor requires expect/actual because there is no native cross-platform support. On Android use OkHttp's CertificatePinner with sha256 public key hashes; on iOS use the Darwin engine with an NSURLSessionDelegate challenge handler that rejects mismatched pins.

What library detects root and jailbreak in Kotlin Multiplatform?▼

freeRASP by Talsec ships a dedicated KMP variant (com.aheaditec.talsec.security:freeRASP_KMP) that detects rooting, jailbreak, Frida/Xposed hooking, repackaging, and debuggers from one shared codebase across Android and iOS.

Does Ktor support SSL pinning natively on all platforms?▼

No, Ktor has no native cross-platform pinning support — this is verified, not assumed. Pinning must be implemented per engine: CertificatePinner on the OkHttp engine for Android and a challenge handler on the Darwin engine for iOS.

How do I store tokens encrypted in a KMP app?▼

Use KSafe, a KMP encrypted-storage library that encrypts by default with Android Keystore and iOS Keychain backing. It needs no expect/actual code and supports WARN/BLOCK policies for rooted devices and attached debuggers.

Does R8 obfuscation protect the iOS side of a KMP app?▼

No, R8 only covers Android. The iOS/Kotlin-Native release framework needs its own stripping via Xcode Archive settings: Deployment Postprocessing, Strip Linked Product, and Additional Strip Flags set to -rSTx.

Why is client-side root detection not enough for app security?▼

A rooted or jailbroken device can bypass any client-side check, including freeRASP's signals, given a determined attacker. Client-side detection only raises attack cost; entitlements and purchase validation must still be verified server-side.

Related Skills

Explore More Software Engineering Skills→
pddhktpddhkt
1

ktor

Standardize Kotlin Multiplatform HTTP client patterns with Ktor.

Community
Intermediate
tartinerlabstartinerlabs
7

security

Audit JavaScript/TypeScript repositories for secrets and OWASP Top 10 vulnerabilities.

Official
Advanced
TacuchiTacuchi

playstore-android-native

Prepare native Android projects for Google Play Store release with signing and AAB verification.

Community
Advanced
thejefflarsonthejefflarson
20

insecure-local-storage

Detect insecure local data storage patterns exposing credentials, tokens, and PII.

Community
Intermediate