real_device #

28 device security checks for Flutter. Detect rooted/jailbroken devices, emulators, hooking frameworks, VPN connections, biometric status, and more — in a single call or one at a time.

Screen capture, screen recording, and overlay/tapjacking detection are handled separately by no_screenshot.

Installation #

dependencies:
  real_device: ^0.1.0

flutter pub get

No additional setup required. No permissions are forced — checks degrade gracefully when permissions are missing.

Usage #

Run all checks at once #

import 'package:real_device/real_device.dart';

final report = await RealDevice.instance.getSecurityReport();

if (report.isSecure) {
  // All clear
} else {
  // Inspect individual groups
  if (!report.deviceIntegrity.isSecure) { /* rooted, emulator, etc. */ }
  if (!report.appTampering.isSecure)    { /* hooking, debugger, etc. */ }
  if (!report.networkEnvironment.isSecure) { /* VPN, proxy, etc. */ }
}

Run a single check #

final rooted = await RealDevice.instance.isRooted;
final vpn    = await RealDevice.instance.isVpnActive;
final bio    = await RealDevice.instance.isBiometricEnrolled;

Skip checks you don't need #

final report = await RealDevice.instance.getSecurityReport(
  config: SecurityConfig(
    skipChecks: {'isVpnActive', 'isProxyConfigured'},
    skipHardware: true,
  ),
);

Skipped fields return null in the report — they are ignored by isSecure.

Request platform attestation tokens #

// Android — returns a Play Integrity token (server-side verification is your responsibility)
final playToken = await RealDevice.instance.getPlayIntegrityToken();

// iOS — returns a DeviceCheck token
final dcToken = await RealDevice.instance.getDeviceCheckToken();

// iOS — generates an App Attest key ID
final attestKeyId = await RealDevice.instance.getAppAttestKeyId();

Security Checks #

Device Integrity #

App Tampering #

Network Environment #

Biometric & Identity #

Hardware #

Models #

All status models use bool? fields: null = skipped or not applicable, false = checked and safe, true = threat detected (or capability present for informational checks).

Platform Notes #

• Checks not applicable to a platform return false or null, never throw.
• Play Integrity / DeviceCheck / App Attest return tokens only — server-side verification is your responsibility.
• No permissions are requested automatically; checks degrade gracefully.

Requirements #

Android Permissions (optional) #

No permissions are required. Some checks return limited results without:

• ACCESS_NETWORK_STATE — VPN and proxy detection
• READ_PHONE_STATE — SIM detection
• NFC — NFC status

iOS #

Add to Info.plist if using NFC detection:

<key>NFCReaderUsageDescription</key>
<string>NFC is used to check device capabilities.</string>

iOS plugin supports both Swift Package Manager and CocoaPods.

Related #

• no_screenshot — screen capture, recording, and overlay/tapjacking prevention.

License #

BSD 3-Clause. See LICENSE.