guardianMOBILE RELEASE ANALYSISGet early access
Menu
MOBILE RELEASE ANALYSIS · RUNS LOCALLY

Find mobile release blockers
before your users do.

Guardian reviews iOS, Android and Flutter projects for security risks, release-compliance issues and missing release evidence — on your own machine, without uploading your source code.

Get early access See what Guardian checks
  • No repository upload
  • Runs offline
  • iOS · Android · Flutter
GUARDIAN / RELEASE REVIEW
PROJECT DETECTED

Atlas Mobile

Flutter · iOS · Android

Local only
RELEASE GATE

Hold for review

2 blockers need your attention

08/10Analyzers completed
02Release blockers
06Total findings
ANALYSIS COVERAGESTATUS
Security analysis1 blocker
Release compliance1 blocker
QA evidenceIncomplete
Source stays in your environment.
Sample data — not a real project.
01 / WHAT GUARDIAN CHECKS

Three questions,
answered before you ship.

Is it safe, is it ready for the store, and can you explain the decision to someone who was not in the room?

In the CLI today

Security analysis

Catch the security problems that stop a release, while they are still cheap to fix.

What Guardian checks

  • Insecure transport configuration. Release configuration that permits cleartext traffic beyond a documented exception, on Android and iOS.
  • Source and configuration risk indicators. Risk patterns in project source and platform configuration across iOS, Android and Flutter.
  • Binary, dynamic and SBOM analysis groups. The CLI ships dedicated command groups for binary analysis, dynamic analysis and SBOM generation.
Why it matters
A security finding discovered during store review costs a release slot. The same finding in a local scan costs an afternoon.
What you get
Findings with severity, location and a remediation step — plus an explicit list of what could not be checked.
Preview

Mobile release compliance

Know the store and platform requirements are met before you upload the build.

What Guardian checks

  • Missing privacy purpose declarations. Privacy-sensitive capabilities represented in iOS release metadata without corresponding purpose text.
  • Release configuration and store-readiness evidence. Platform release settings and the evidence a store submission expects to find.
  • Missing QA evidence stays visible. Test results that were never supplied are reported as incomplete coverage. They never quietly become a pass.
Why it matters
Store rejections are slow, unpredictable and land after the work is already declared finished.
What you get
A per-check coverage list showing what completed, what is incomplete and what did not run.
In the CLI today

Release gate and reporting

Turn findings into a release decision that you can explain to someone else.

What Guardian checks

  • A release check you can run in CI. guardian release check runs the release workflow and exits on the configured policy.
  • Reports in the format your pipeline reads. guardian scan --format text, json, sarif, gitlab or html, written to a file with --output.
  • Compare against a baseline. --baseline with --fail-on-new blocks on newly introduced findings instead of on your existing backlog.
Why it matters
A gate nobody can explain gets switched off. A gate that fails the whole backlog on day one gets switched off faster.
What you get
A pass or hold decision tied to the findings, the coverage and the policy that produced it.

Seven further review areas — project detection, code review, QA readiness, dependencies and SBOM, architecture signals, CI/CD and binary analysis — are on thecapabilities page , and every documented check has its own entry, status and false-positive notes in thechecks catalogue

02 / SEE THE OUTPUT

What a review
actually tells you.

The same scan, read three ways. Switch between them the way you would while deciding whether a build ships.

Atlas Mobile · Flutter · iOS · Android

Risk in the source and configuration, plus what arrived from outside your own code.

1 release blocker
SEC-001HighRelease blocker

Cleartext traffic permitted

Android · application configuration

The synthetic release configuration permits cleartext traffic beyond a documented exception.

Restrict release network policy to encrypted transport; document any narrowly scoped exception and re-run the check.

DEP-004Medium

Dependency constraint is broad

Shared · dependency declaration

A sample dependency allows changes beyond the documented review range. No vulnerability claim is made.

Review and constrain the accepted version range; update and retain the lockfile.

What the store and the platform expect to find before the build is accepted.

1 release blocker
REL-002HighRelease blocker

Privacy purpose declaration missing

iOS · release metadata

A privacy-sensitive feature is represented without corresponding purpose text in the sample release metadata.

Review the feature and add accurate purpose text where required. Validate the final release configuration against current platform requirements.

CI-005Medium

Test evidence is not attached to the gate

CI/CD · sample pipeline

The sample pipeline does not supply test results to the release policy evaluation.

Attach the relevant test artifact and require explicit handling of missing evidence.

The decision, and the findings, coverage and policy that produced it.

Hold for review
SEC-001HighRelease blocker

Cleartext traffic permitted

Android · application configuration

The synthetic release configuration permits cleartext traffic beyond a documented exception.

Restrict release network policy to encrypted transport; document any narrowly scoped exception and re-run the check.

REL-002HighRelease blocker

Privacy purpose declaration missing

iOS · release metadata

A privacy-sensitive feature is represented without corresponding purpose text in the sample release metadata.

Review the feature and add accurate purpose text where required. Validate the final release configuration against current platform requirements.

Why the gate is holding

  • Two high-severity findings are marked as release blockers by the configured policy.
  • One check reported incomplete coverage, and one did not run at all.
  • Incomplete coverage is never counted as a pass, so the gate holds rather than clearing.

Sample data — not a real project.

  1. Project selected

    A local path. Nothing uploaded.

  2. Local scan runs

    Analyzers read source and configuration.

  3. Blockers surfaced

    With severity, location and coverage.

  4. Decision generated

    Findings plus coverage plus policy.

A diagram of the sequence, not a recording of the application.
03 / HOW IT RUNS

Point it at a project.
Read the decision.

Six steps from a project path to a release report you can attach to a ticket.

Run your first scan When teams run a review
  1. 01

    Point Guardian at a project

    Run it against a project in your environment. There is no repository upload step.

  2. 02

    Detect the structure

    Guardian identifies the platform and selects the analysis paths that apply.

  3. 03

    Run the analysis locally

    Configured analyzers read local source and configuration on your machine.

  4. 04

    Read findings and coverage together

    Evidence, risks and checks that could not run are reported separately.

  5. 05

    Fix, re-run, or record an exception

    Policy exceptions are recorded with a reason rather than hidden.

  6. 06

    Generate the release report

    The gate decision is written out with the findings, coverage and policy behind it.

04 / YOUR ENVIRONMENT, YOUR CONTROL

Keep your code close.
Keep the choice yours.

Analysis happens where your code already is. Sharing anything at all is a separate, optional decision you make later.

Local analysis trust boundary

YOUR ENVIRONMENT PRIVATE BOUNDARY

Private project

Source · builds · secrets

Guardian local engine

Analysis · coverage · policy

Local findings & reports

Inspect · fix · re-run

A local scan completes without a network connection.

How Guardian handles your project

How Guardian handles analysis location, data movement and release decisions
Where analysis runsOn your machine, against a local project path.
Is a source upload requiredNo. There is no repository upload step in a scan.
Does it work offlineYes for local analysis. Vulnerability intelligence is only as fresh as your local data.
What may leave the machineNothing by default. Optional findings sharing is planned, opt-in, and sends normalized, redacted findings you approve first.
How incomplete coverage is reportedAs incomplete, per check. A check that could not run never counts as a pass.
How a release decision is explainedThe gate result is reported with the findings, coverage and policy that produced it.
Read the security model
SEE IT RUN

Proof, not promises.

The strongest thing we can show you is Guardian working on a real project. Until that recording is captured and cleared for publication, we would rather say so than show you a mockup and call it a demo.

Recording in preparation

  • A recording of a scan running against a public open-source mobile project, from detection to release gate.
  • A screenshot of the Guardian CLI report output, with no private paths or project names.
  • A screenshot of the macOS application, once a verified release build exists.

What you can inspect today is the report format itself — the same structure a real scan produces, filled with sample data and labelled as such.

Inspect the example report
A FEW THINGS TO KNOW

Clear answers.
No fine-print surprises.

Do I need to upload my repository?

No. Guardian analyses a project path on your machine. There is no upload step in a scan.

Can Guardian work offline?

Yes, for local analysis. Vulnerability intelligence is only as fresh as the data you have locally, and a connected feature must never prevent a local scan from completing.

Can I download the macOS app yet?

Not yet. The distribution build is completing signing and notarization verification, and we publish it when those pass. Therelease status page has the detail.

Does a passing gate guarantee a safe release?

No. The result depends on the analyzers that ran, the evidence available and the policy you configured. Missing coverage stays visible, and engineering judgement is still required.

Where do I read the documentation?

The documentation overview has the paths: run the CLI, set up CI/CD, understand reports, or review the security model.Questions and answers covers the rest.

What does early access actually involve?

An email when there is a build worth your time, and a conversation about your release workflow. We ask for an email address and nothing about your projects.

A CLEARER PATH TO RELEASE

Make the next release
an informed decision.

Register interest and we will get in touch when there is a build worth your time.

Get early access