guardianMOBILE RELEASE ANALYSISGet early access
Menu
WHAT GUARDIAN CHECKS

Ten review areas. One release decision.

Security, store readiness and release policy are the three that block a launch. The other seven change how much you trust the answer.

RELEASE-BLOCKING

The three that stop a launch.

These decide whether a build ships. Everything below feeds into them.

In the CLI today

Security analysis

Catch the security problems that stop a release, while they are still cheap to fix.

What Guardian checks

  • Insecure transport configuration. Release configuration that permits cleartext traffic beyond a documented exception, on Android and iOS.
  • Source and configuration risk indicators. Risk patterns in project source and platform configuration across iOS, Android and Flutter.
  • Binary, dynamic and SBOM analysis groups. The CLI ships dedicated command groups for binary analysis, dynamic analysis and SBOM generation.
Why it matters
A security finding discovered during store review costs a release slot. The same finding in a local scan costs an afternoon.
What you get
Findings with severity, location and a remediation step — plus an explicit list of what could not be checked.
Preview

Mobile release compliance

Know the store and platform requirements are met before you upload the build.

What Guardian checks

  • Missing privacy purpose declarations. Privacy-sensitive capabilities represented in iOS release metadata without corresponding purpose text.
  • Release configuration and store-readiness evidence. Platform release settings and the evidence a store submission expects to find.
  • Missing QA evidence stays visible. Test results that were never supplied are reported as incomplete coverage. They never quietly become a pass.
Why it matters
Store rejections are slow, unpredictable and land after the work is already declared finished.
What you get
A per-check coverage list showing what completed, what is incomplete and what did not run.
In the CLI today

Release gate and reporting

Turn findings into a release decision that you can explain to someone else.

What Guardian checks

  • A release check you can run in CI. guardian release check runs the release workflow and exits on the configured policy.
  • Reports in the format your pipeline reads. guardian scan --format text, json, sarif, gitlab or html, written to a file with --output.
  • Compare against a baseline. --baseline with --fail-on-new blocks on newly introduced findings instead of on your existing backlog.
Why it matters
A gate nobody can explain gets switched off. A gate that fails the whole backlog on day one gets switched off faster.
What you get
A pass or hold decision tied to the findings, the coverage and the policy that produced it.
SUPPORTING REVIEW AREAS

The seven that inform them.

Availability labels are stated once per area. Where a check could not run, Guardian reports it as incomplete rather than as a pass.

In the CLI today

Project detection

Start from the real shape of the project rather than a configuration file you have to write first.

What Guardian checks

  • Platform and structure detection. guardian detect identifies platform and project structure and selects the applicable analysis paths.
  • iOS, Android and Flutter scope. Mobile projects are the scope. Applicable checks vary with structure and configuration.
Preview

Code review signals

Maintainability and correctness signals with enough context to act on.

What Guardian checks

  • Suppressed failure states. Error paths that discard an actionable failure instead of surfacing it.
  • Review scoped to what changed. A baseline file keeps a review focused on newly introduced findings.
Preview

QA and test readiness

Make the gaps in your evidence as visible as the failures in it.

What Guardian checks

  • Missing and skipped test evidence. Test results that were not supplied are reported as incomplete, not as a pass.
  • Evidence attached to the gate. A pipeline that never supplies test results to the policy evaluation is itself a finding.
Preview

Dependency and SBOM review

See the risk that arrives from outside your own code.

What Guardian checks

  • Dependency declarations and constraints. Version ranges that accept changes beyond the documented review range.
  • SBOM generation. The CLI ships a dedicated SBOM command group for producing a software bill of materials.
Preview

Architecture and performance signals

Structural patterns worth a conversation before they harden.

What Guardian checks

  • Module boundary coupling. Presentation components that own data access directly, and similar boundary erosion.
  • Static performance indicators. Structural indicators drawn from the source. These are signals, not runtime measurements.
Preview

CI/CD review

Review the path from a commit to a shipped build, not only the code.

What Guardian checks

  • Pipeline and release-control configuration. Release controls that exist in policy but are not enforced by the pipeline.
  • Machine-readable output for your platform. SARIF and GitLab report formats are produced by the bundled CLI.
Preview

Binary and dynamic analysis

Look at the artefact you are about to ship, not only the source it came from.

What Guardian checks

  • Binary analysis command group. The bundled CLI ships a dedicated command group for analysing built artefacts.
  • Dynamic analysis command group. A separate command group covers dynamic analysis workflows.
PLATFORM SCOPE

iOS, Android and Flutter

Mobile projects are the scope. Which checks apply depends on your project structure and configuration, and Guardian reports the ones that did not.

INTERFACES

A local core, two front ends

The Python analysis core and CLI are the engine. The macOS application is a native front end that calls the same core through a JSON boundary, so the CLI stays the source of truth.

CLI reference
REPORT FORMATS

Evidence you can revisit

guardian scan --format accepts text, JSON, SARIF, GitLab and HTML, written to a file with --output.

See an example report

Go deeper

Incomplete is not a pass

A skipped check is still a question.

Unavailable analyzers, missing test artefacts and unsupported configurations are reported as incomplete coverage. A release decision needs both the findings and the limits of the analysis that produced them.

A CLEARER PATH TO RELEASE

Make the next release
an informed decision.

Register interest and we will get in touch when there is a build worth your time.

Get early access