Necessary for Flutter 0.1.9 adds Android measurements whose readings come close to proof of an attack.
Every scan now carries app_host, which says whether another app runs
yours inside its own, where it can see and change everything your app shows and sends.
debug_state says whether a debugger thread runs in your app,
other_access names the app that handles calls and the store that
installed it, and emulator reads the processor, so an emulator is told
even when its build claims to be a real device.
A reading the SDK could not take now says so, rather than being taken from what a failed command printed.
The integration guide's new section 7.7 lists the genuine users who can
show each of these readings, how to tell them apart, and what to do. As always, the SDK only measures;
your backend decides.
NecessarySdk 0.1.10 adds a new measurement, runtime, to every scan on
Android and iOS. It reports the version of the .NET runtime an app was built with, whether the app carries
a Brotli decoder, and that decoder's version where it can be read. With it, your backend can find the
installs still running a release built on a runtime with a known flaw, such as the Brotli decoder flaw
CVE-2026-111497, fixed in .NET 8.0.33, 9.0.22 and 10.0.14. It can then ask people to update, or hold back
sensitive requests until they do. As always, the SDK only measures; your backend decides.
On iOS, the comparison of the app's code in memory with its files now also covers apps built with
NativeAOT, which keep their .NET code in a section of their own.