Jailbreak detection

Security Senior Swift 5.0+ iOS 17+ Reviewed 31 Oct 2026 By Alok Singh

Pick the fix

A banking app wants to stop fraud from compromised devices. Best approach?

OptionsUse App Attest and server-side risk checks, treating client jailbreak signals as one inputAdd more file-existence checks in the appCrash the app when a jailbreak is suspectedObfuscate the detection code

Hint 1 of 1

Who controls the device?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Use App Attest and server-side risk checks, treating client jailbreak signals as one input

Correct. Decisions happen where the attacker can't change them.

Why not the others?

B Add more file-existence checks in the app. They're bypassed with hooking tools.
C Crash the app when a jailbreak is suspected. It's bypassable and punishes false positives.
D Obfuscate the detection code. It slows attackers down, but the check still runs on their device.

30-second answer

Jailbreak detection looks for signs of a modified device, such as known files, writable system paths or injected libraries. Every check runs on a device the attacker controls, so it can be bypassed. Treat it as one risk signal, and rely on server-side checks such as App Attest and DeviceCheck, plus limits that hold even on a compromised device.

Practise saying it · 30 s. No recording, just a timer

Explain jailbreak detection's limits.

Say your answer out loud, then check which of these points you covered:

Client checks are bypassable
Risk signal only
App Attest and server checks

Deep dive

App Attest proves app integrity to your server.

DeviceCheck stores two bits per device on Apple's servers, for example to flag abuse.

Decide what to do on a positive: warn, limit features or inform the server.

False positives frustrate honest users.

Common mistakes

Blocking the app entirely on a weak signal.
Treating detection as security.

Senior take & follow-ups

Seniors call it a speed bump and design server-side controls.

Follow-up questions

Think of your answer first, then open the hint.

What should happen on detection?
Show hint
Report a risk signal; the server decides.
What can App Attest do that detection can't?
Show hint
Produce a server-verifiable attestation.

Suggest a fix if something here is wrong or out of date.