Changed #

• RootDetectionGuard now blocks only on a critical-severity threat in a blocking category (privilegedAccess, runtimeManipulation, integrityViolation), and drives the blocked-screen message from that same set. Signals that also occur on clean, non-rooted devices are reported at high/medium and are surfaced but no longer trigger a block. Every definitive root/jailbreak indicator (su binary, Magisk daemon/socket/mounts/app-dir/properties, Zygisk injection, root-manager app, /system mounted read-write, Frida/Xposed hooks, wrong APK signer) is reported at critical, so genuinely rooted or jailbroken devices are still blocked.
• RootDetectionGuard blocked screen now shows a fixed user-facing message (the default "This device is rooted or jailbroken." text, or the provided blockedMessage) with a "Show error logs" link that opens a popup listing every blocking threat. Previously the first detected threat's raw description was shown as the headline, which could surface a non-blocking finding (e.g. an attached debugger) as the apparent block reason.

Fixed #

• Access Denied on clean, non-rooted devices caused by non-root heuristics that fell into a blocking category regardless of severity — an enabled accessibility service (e.g. the Grammarly keyboard or password managers), rwxp JIT pages (ART on Android 10+), test-keys / userdebug builds (GSI, AOSP, some OEM ROMs), an unlocked bootloader (developer phones), BusyBox, or permissive SELinux. These are now reported without blocking (see Changed).
• False "Native ptrace/TracerPid check: debugger attached" block on ordinary, non-debugged devices. The native isDebuggerPresent() check used a ptrace(PTRACE_TRACEME) self-attach that marked the process as traced by its parent and could not be undone from the tracee side, polluting the subsequent /proc/self/status TracerPid read with a non-zero parent pid. The check now relies solely on the non-destructive TracerPid read (0 when clean, the tracer pid when a debugger is attached).

Added #

• bypassInDebugMode flag on RootDetectionGuard — when set to true, the root/jailbreak check is skipped entirely in debug builds (kDebugMode == true), allowing installation and testing on normal (non-rooted) developer devices without triggering the blocked screen. Has no effect in profile or release builds.

Changed #

• Shortened package description to comply with pub.flutter-io.cn 180-character limit
• Added homepage, repository, and issue_tracker URLs to pubspec.yaml

Added #

• Initial release of advance_root_detection Flutter RASP plugin
• Android root detection: su binaries, Magisk/Zygisk artifacts, test-keys, dangerous props, root manager packages
• Android hooking detection: Frida (port + process + maps), Xposed/LSPosed/EdXposed, Cydia Substrate
• Android emulator detection: Build fingerprint, QEMU props, telephony, sensor count, emulator files
• Android debugger detection: Debug.isDebuggerConnected, FLAG_DEBUGGABLE, TracerPid, native ptrace anti-attach
• Android app integrity: APK signing certificate SHA-256, installer package, package name, APK hash
• Android environment signals: screen capture, accessibility services, VPN, developer mode/ADB
• Android NDK C++ hardening layer: native ptrace anti-debug, syscall-level /proc/self/maps scan, inline-hook detection, JNIEnv integrity, .text segment integrity, XOR-obfuscated strings
• iOS jailbreak detection: classic + modern paths (Dopamine, palera1n, rootless), URL schemes, sandbox escape, writability tests
• iOS hooking detection: Frida gadget scan, Cycript, Substrate, libhooker, DYLD_INSERT_LIBRARIES
• iOS debugger detection: sysctl P_TRACED, ptrace(PT_DENY_ATTACH)
• iOS app integrity: provisioning profile, bundle ID, code-signing, install source
• iOS simulator detection: TARGET_OS_SIMULATOR, env vars, hardware model
• Dart public API: performCheck(), startMonitoring(), stopMonitoring(), verifyBeforeSensitiveOp(), threatStream
• ThreatReport, Threat, ThreatCategory, Severity, SecurityConfig, AndroidConfig, IOSConfig data models
• MethodChannel (flutter_security_shield/methods) + EventChannel (flutter_security_shield/threats)
• Example app with Material 3 dashboard showing live threat status per category
• Dart unit tests with mocked MethodChannel