Bayesian fusion across motion, vision, audio: when one modality lies
Multi-modal presence verification. Inverse-variance weighting, when one channel goes adversarial, and why the fused metric refuses to flap.
Sentinel Den · Engineering blog
Engineering deep-dives on mobile app security: jailbreak/root detection, TLS pinning, payload encryption above TLS, Secure Enclave & Keystore residency, on-device LLM sandboxing.
Latest posts
AnomalyKit + RuntimeGuard + BehaviorGuard: layered tamper detection
Why no single-signal detector catches a real attack. Statistical anomalies + hard-edge runtime indicators + behavioral drift, fused with a sliding-window consensus policy.
Shipping a clean App Store privacy review: ScreenGuard + RedactKit + ManifestGuard + EnclaveVault
Apple's privacy review asks four questions. Four SDKs answer them at code level. PrivacyInfo.xcprivacy, on-device PII, capture protection, enclave storage.
AgenticGuard + IntentKit + RuntimeGuard: the verify-classify-defend stack
Three layers for an iOS LLM-agent app. RuntimeGuard is the floor, IntentKit classifies the input, AgenticGuard scopes the tool dispatch. Order matters.
BehaviorGuard + PresenceKit: composing risk-engine input with NPU verification
Wiring PresenceKit's PresenceMetrics stream into BehaviorGuard's hysteretic 4-band risk engine. The integration loop, the back-pressure design, the math.
On-device PII redaction across visual, audio, text in one policy
Three modalities, one declarative RedactionPolicy. Why a single allow/block surface beats hand-rolling per-engine code.
Detection is not defense: we measured our own injection classifier on novel attacks
Everyone quotes a prompt-injection benchmark number. We ran ours against attacks it had never seen (40% recall on the held-out set) and we're publishing it, because the authorization layer is what actually stops the attack.
Catching hidden Required-Reason API calls in vendor SDKs
Your privacy manifest declares what your code reads. What about the analytics SDK quietly polling SystemBootTime? Debug-time auditing for vendor dependencies.
Telemetry-anomaly detection on-device with explicit_bzero hygiene
Detecting anomalies in app telemetry without ever sending raw logs off-device. mlock'd buffers, explicit_bzero, INT4 inference.
Offline SLM intent extraction without the cloud round-trip
On-device small language models for natural-language intent classification. Latency, energy, privacy. The case for on-device + the cost.
NPU-pinned continuous presence verification on iPhone 17 Pro
Anchoring vision inference to the Apple Neural Engine on iPhone 17 Pro. Latency, energy, thermal throttling, and why ANE-first dispatch matters.
Training a per-app behavioral biometrics model on-device with Core ML
BehaviorGuard ships a baseline ensemble that works day one. How to train a per-customer model on your app's real user population, on-device, no upload.
OAuth 2.0 for iOS in 2026: PKCE, PAR, DPoP, and JAR
PKCE was 2015's OAuth hardening for mobile. PAR, DPoP, and JAR are 2026's. What each fixes, when to use which, and how they compose for regulated iOS apps.
Memory analysis of iOS apps via Studio: what page tables tell you
Static analysis tells you what an app could do; memory analysis tells you what it's doing now. The workflow for inspecting a running iOS app in Studio.
Lockdown Mode and your security SDK: detecting + responding
Lockdown Mode is user opt-in but it shifts your app's runtime profile in ways your SDK must detect and adapt to. Treating Lockdown users the same is a failure.
iOS background-location threat model: the surface nobody documents
Background location is treated as a UX concern. It's also an attack surface; the threat model for Always authorization is more elaborate than most ship.
macOS Sequoia 15 and Studio's audit pipeline: what survives SIP
macOS Sequoia tightened SIP on inter-process calls. For SentinelDen Studio Frida-based instrumentation, that changes which parts need entitlements.
mTLS revocation done right: when CRL is too slow
Client mTLS revocation isn't solved by CRLs or OCSP; both bake in latency that doesn't match how compromised mobile credentials get used. The alternative.
Tamper-evident logging on iOS: hash-chained, HMAC-signed audit ledgers
An audit log editable by the host app or anyone with jailbreak filesystem access isn't an audit log. The hash-chain plus HMAC-signature plus off-device-replication pattern, and the real BehaviorGuard AuditLog that implements it.
codesign -dvv and the resource directory: what your signature claims
`codesign -dvv` is the canonical "is this app properly signed" check. It is also the most-misread output in iOS forensics.
The iOS 17/18/19 security-API deprecation matrix
Apple deprecates security APIs every release. Three iOS versions of accumulated deprecations means most pre-2024 codebases ship silent App Review rejections.
Making behavioral biometrics observable: BehaviorGuard telemetry
Behavioral biometrics SDKs default to a black-box risk score. Triage, drift detection, and forensics need structured telemetry. The schema and metric surface.
Apple Private Cloud Compute: rethinking your AgenticGuard threat model
When an on-device LLM agent hands off a prompt to Private Cloud Compute, AgenticGuard tool-permissioning and audit trail span two trust domains. What changes.
Self-custody wallets on iOS: secure-input plus Secure-Enclave
Self-custody wallets need two rare things: every seed-phrase keystroke in a protected buffer, and the signing key non-extractable even on compromise.
xcprivacy-lint: declaring required-reason APIs your SDK is calling
App Store review rejects iOS 17+ apps whose PrivacyInfo.xcprivacy misses any required-reason API. The hard part is finding the ones your dependencies hide.
Auditing an .xcarchive you didn't build: forensic patterns
When a customer ships an .xcarchive after an incident, the build environment is gone but the artifact is rich. A defensible audit without a rebuild.
Beyond Frida: detecting the long-tail injection toolchain in 2026
Most iOS injection checks in 2026 are scoped to Frida and miss Theos hooks, dyld interposing, ObjC swizzling, and runtime-hopping bypass kits.
PCI-DSS 4.0 mobile on iOS: mapping requirements to ScreenGuard
PCI-DSS 4.0 added explicit mobile requirements in 6.2 and 8.6. The line-by-line mapping from each screen-layer requirement to an iOS control via ScreenGuard.
App Attest plus DeviceCheck: iOS identity for revocable enrollment
App Attest proves the binary, DeviceCheck persists two bits across reinstalls. How EnclaveVault wires them together for revocable enrollment.
Verifying an on-device agent's audit chain off-device: the CI replay
The agent emits a hash-chained, Secure-Enclave-signed audit log. The CI-side verification protocol and Swift CLI for regulators and incident responders.
Face ID isn't a liveness check: behavioral signals as companion
Face ID matches a template; it doesn't verify the face is conscious or driving the session. How BehaviorGuard composes with biometrics, not against them.
SentinelDen Studio CVE feed: Ed25519 signatures and supply-chain trust
Auditing iOS binaries means trusting a CVE feed. How the feed works, why every entry is Ed25519-signed, and what the redirect guard prevents.
Step-up auth on risk, not fat-finger taps: hysteretic transitions
Stepping up on every threshold crossing produces auth fatigue. The hysteretic state machine BehaviorGuard uses to distinguish session-takeover from brief noise.
Capability-based tool permissioning for on-device LLM agents on iOS
A typed tool registry says what an agent can call, not whether the caller may call it now. The capability-handle pattern that closes the authorization gap.
Three ReplayKit and AirPlay bypass techniques seen in the wild in 2026
UIScreen.isCaptured misses real bypasses: USB-C alt-mode displays, jailbreak mirroring kexts, CarPlay screen-sharing. Three patterns and the fix.
Detecting pasteboard reads on iOS 16+ without triggering the banner
iOS 16's paste banner fires on every UIPasteboard.general.string call. How changedNotification and changeCount let a security tool observe without reading.
mTLS on iOS vs Android: why the Secure Enclave wins on device identity
Both platforms support mTLS and hardware-backed keys. The engineering diverges sharply on ship. Why the Secure Enclave model is structurally stronger.
HIPAA Technical Safeguards on iOS: 45 CFR § 164.312 to ScreenGuard
HIPAA § 164.312 is auditor-facing prose. The line-by-line mapping from each safeguard to a concrete iOS control, and what ScreenGuard's .hipaa preset ships.
iOS clipboard threat model: why UIPasteboard fails crypto wallets
UIPasteboard is shared, synced via Universal Clipboard, and readable by siblings. The in-process AES-GCM clipboard pattern that closes every leak path.
PSI drift detection on iOS: when has the user's baseline changed?
Behavioral biometrics rely on a stable user feature distribution. Population Stability Index detects when behavior has drifted past the baseline's range.
Forensic HMAC watermarks on iOS: attributing a leaked screenshot
Visible CONFIDENTIAL stamps don't survive cropping. HMAC-signed invisible watermarks do, recoverable via Vision OCR. How they work, what they catch.
BIP-39 verification on iOS: confirming the user wrote down the phrase
Most wallet apps show the mnemonic and trust 'I wrote it down'. The BIP-39 verification pattern that catches recovery failures before access is lost.
Ten on-device behavioral signals on iOS and what each catches
BehaviorGuard ships 10 behavioral collectors, each with its own threat coverage and false-positive profile. What each measures, what it catches, who opts in.
iOS screen-capture: why UIScreen.isCaptured alone isn't enough
Most apps rely on UIScreen.isCaptured plus an overlay. That misses AirPlay timing, screenshot bursts, ReplayKit-from-another-app, and camera attacks.
Every place an iOS keyboard leaks before your mnemonic hits the wallet
iOS keyboards leak across six surfaces between tap and in-memory secret. Each surface, the actor it leaks to, and the engineering pattern that closes it.
Continuous authentication on iOS: why one-shot Face ID isn't enough
Face ID is a great unlock primitive, a poor session-integrity one. What fails when biometry is treated as session auth, and the continuous-auth shape on 17+.
Static analysis for iOS: 8 pre-submission defects to catch first
App Review rejection costs a week. Most incidents start as static-findable defects. The 8 patterns SentinelDen Studio catches pre-submission, with Swift fixes.
Dopamine and palera1n: rootless jailbreak detection without misfires
Rootless jailbreaks shift every iOS 7-11 detection assumption. The legacy path list fails on Dopamine, palera1n, and Taurine. What to probe instead.
iOS Secure Enclave key persistence: re-enrollment to factory reset
Secure Enclave keys survive some events, not others, in ways the docs miss. A tested matrix: Face ID re-enrollment, lockout, restore, factory reset, OS upgrade.
OWASP MASVS for iOS: applying the standard to a real .ipa
MASVS is the closest thing to an iOS security standard. What each control requires, how to verify on a shipped .ipa, and where the standard leaves you alone.