sentinelden.com · Docs · Engineering blog · Engineering · Trust · Status
12 SDKs, iOS and Android · code-signed .xcframework and SHA-256-verified .aar
· zero third-party dependencies on iOS · independent, no outside funding
Vendor-grade iOS and Android security SDKs, binary-audit tooling, and engineering writing, by Muhammad Khan from Vancouver, British Columbia.
Every SDK ships as a code-signed .xcframework on iOS and a SHA-256-verified
.aar under com.sentinelden on Android, published under a registered Apple
Developer Team ID you can check yourself at
/verify. One idiomatic entry point, one typed
error surface, no swizzling in your release build. Learn one SDK and you know
all twelve, on either platform.
| Product | What it does | |
|---|---|---|
| Runtime | RuntimeGuard | Jailbreak, debugger and dylib-injection detection, integrity attestation, App Attest cross-signing, risk-scored reports |
| BehaviorGuard | Continuous behavioral biometrics: touch dynamics, motion, keyboard rhythm, with on-device baseline learning | |
| PresenceKit | NPU-pinned presence verification: liveness, gaze, face-region pinning beyond Face ID | |
| Data | PayloadGuard | Multi-pin SPKI TLS validation plus ECDH and AES-256-GCM payload encryption above TLS, with replay-bound AAD |
| EnclaveVault | Typed wrapper around the Secure Enclave and Android Keystore, with policy-drift refusal on bootstrap | |
| RedactKit | On-device PII redaction across visual, audio and text, routed across the Neural Engine, GPU and CPU | |
| Surface | ScreenGuard | Capture protection, forensic HMAC watermarks, ReplayKit-bypass defenses |
| InputGuard | Secure keyboard, clipboard isolation, paste-source attestation | |
| Agents | AgenticGuard | On-device LLM agent sandbox: typed tool registry, fail-closed intent verification, egress policy, hash-chained audit trail |
| IntentKit | Offline SLM intent engine, natural language to structured tool calls, Ed25519-signed model artifacts | |
| AnomalyKit | On-device anomaly detection across telemetry, sensors, acoustics and behavior | |
| Audit | ManifestGuard | Debug-only privacy-manifest auditor, compiles to nothing in Release |
| SentinelDen Studio | Notarized macOS app auditing .ipa, .app, .apk and .aab against OWASP MASVS, with SARIF, CycloneDX SBOM and PDF output |
Source for the commercial products is closed. The integration references at sentinelden.com/docs cover the full API surface, and every SDK publishes a threat model with its limits stated.
xcprivacy-lint · MIT
A Swift CLI that validates an iOS PrivacyInfo.xcprivacy manifest against the
API surface a binary actually touches. To be straight about its state: the repo
is pre-v0.1 design scaffolding, and the validator it will expose ships embedded
in Studio today. Contributions welcome.
sentinelctl · brew install sentinelden/tap/sentinelctl
The audit engine as a CLI. Reads .ipa, .app, .apk and .aab, writes SARIF,
CycloneDX SBOM, Markdown and issue-tracker JSON, and its exit code is a build
gate. Free at Community level, and it runs without a licence key.
Seventy-plus technical posts at sentinelden.com/blog, on the problems these SDKs were built to solve. No vendor fluff. RSS.
What it covers
- Jailbreak detection beyond
sysctl, layered Frida detection, Mach-O integrity - TLS pinning under cert rotation, payload encryption above TLS, defeating MITM
- Secure Enclave residency,
biometryCurrentSetvsbiometryAny, App Attest cross-signing - On-device LLM agent sandboxing, prompt injection in production, Foundation Models tool-calling
- Offline SLM intent extraction, INT4 quantization budgets, MLX vs Core ML backend selection
- Continuous behavioral biometrics, NPU-pinned liveness, signals beyond Face ID
- On-device PII redaction across visual, audio and text on one policy surface
- Sensor and acoustic anomaly detection, Bayesian fusion across modalities
- OWASP MASVS on a real
.ipa, macOS hardened-runtime entitlements, SARIF for CI
| Pre-sales, integration, licensing | sentinelden.com/contact |
| Coordinated security disclosure | security@sentinelden.com (policy) |
| General | mk@sentinelden.com |
| Service status | sentinelden.com/status |
Based in Vancouver, British Columbia, Canada. Contracts under BC law, EU and UK consumer-protection compliant. The website is the canonical surface for everything we publish; this org is for code and PR collaboration.
Not affiliated with, endorsed by, or specifically approved by Apple Inc. See trademarks.
