Imagine a user entering a PIN in a banking app while a screen recorder—malicious software or even the built-in recorder—is running. Not only the code but the entire authentication process and viewing of confidential documents could be captured. We have encountered such scenarios dozens of times and know how to protect your app. Screen recording is a more serious threat than a screenshot because it captures dynamic input and animations. On iOS, the built-in Screen Recorder and AirPlay mirroring work at the system level, while on Android the MediaProjection API is accessible to third-party apps with user permission (but malware can trick the user). Our experience: 5+ years in mobile security, dozens of projects with sensitive data protection.
How FLAG_SECURE works on Android
FLAG_SECURE is the primary protection tool on Android, but it is useless against HDMI capture cards or physical cameras pointed at the screen. This is a platform limitation that must be accepted or mitigated with DRM (e.g., Widevine). For all other scenarios, the flag robustly blocks the MediaProjection API.
override fun onCreate(savedInstanceState: Bundle?) { super.onCreate(savedInstanceState) window.setFlags( WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE ) setContentView(R.layout.activity_main) } The flag blocks capture via MediaProjection: the screen recording will get a black rectangle instead of the Activity content. It works for the system recorder and third-party apps using the MediaProjection API. For Jetpack Compose, the same approach at the Activity level—Compose content is inside the same Window. Android Developer Documentation: WindowManager.LayoutParams.FLAG_SECURE
How to detect screen recording on iOS?
iOS does not provide an API to block recording, but it gives a powerful detection tool—UIScreen.isCaptured and UIScreen.capturedDidChangeNotification. We use it on every project with content protection. isCaptured returns true for active built-in recording, AirPlay mirroring, or QuickTime capture. Notably, it does not trigger for single-frame screenshots—an important difference from Android's FLAG_SECURE. The correct reaction is not a crash or logout but hiding sensitive content:
private var cancellables = Set<AnyCancellable>() func setupScreenCaptureProtection() { NotificationCenter.default.publisher( for: UIScreen.capturedDidChangeNotification ) .receive(on: DispatchQueue.main) .sink { [weak self] _ in self?.updateContentVisibility() } .store(in: &cancellables) // check current state on launch updateContentVisibility() } private func updateContentVisibility() { let isBeingRecorded = UIScreen.main.isCaptured sensitiveContainerView.isHidden = isBeingRecorded if isBeingRecorded { recordingWarningView.isHidden = false } } recordingWarningView is a placeholder that the user sees instead of data during recording. This provides both protection and UX explanation.
SwiftUI variant
struct SensitiveContentView: View { @State private var isScreenBeingRecorded = UIScreen.main.isCaptured var body: some View { Group { if isScreenBeingRecorded { RecordingBlockerView() } else { ActualSensitiveContent() } } .onReceive( NotificationCenter.default.publisher( for: UIScreen.capturedDidChangeNotification ) ) { _ in isScreenBeingRecorded = UIScreen.main.isCaptured } } } Flutter and React Native
Both cross-platform frameworks require native plugins for this functionality. Flutter: flutter_windowmanager on Android sets FLAG_SECURE. For iOS, a platform channel with native Swift implementation is needed—no reliable prebuilt packages exist, we write our own. React Native: react-native-flag-secure-android for Android; for iOS, a native module via NativeModules.
App Switcher preview audit
| Platform | App Switcher protection mechanism | Notes |
|---|---|---|
| iOS | Overlay View in sceneWillResignActive |
Requires programmatic overlay |
| Android | FLAG_SECURE |
Works automatically |
iOS: overlay with an overlay View in sceneWillResignActive:
override func sceneWillResignActive(_ scene: UIScene) { overlayView.isHidden = false } override func sceneDidBecomeActive(_ scene: UIScene) { overlayView.isHidden = true } Android: FLAG_SECURE covers this case as well—the App Switcher preview will be black.
Comparison of approaches: FLAG_SECURE vs UIScreen.isCaptured
| Characteristic | FLAG_SECURE (Android) | UIScreen.isCaptured (iOS) |
|---|---|---|
| Protection type | Capture blocking | Detection and reaction |
| Performance | 0% overhead | Minimal delay (1–2 ms) |
| Protection from hardware capture | No | No |
| Ease of implementation | Single flag in Kotlin | Notification subscription in Swift |
| Coverage (screenshots) | Yes | Only video |
FLAG_SECURE reacts 3× faster than polling alternatives, but does not cover hardware attacks. On iOS, detection is instantaneous (<10 ms after recording starts).
Our approach to implementation: what's included
We offer turnkey screen recording protection. The scope includes:
- Audit of the current app architecture for screen capture vulnerabilities.
- Design of protection: selection of optimal methods for your framework and SDK version.
- Implementation in native code (Swift/Kotlin) or via plugins for Flutter/React Native.
- Testing on 5 real devices with different OS versions.
- Documentation of the protection architecture and instructions for developers.
- Training webinar for the team (30 minutes).
Timeline: 1–3 days depending on the number of sensitive screens. A leaked PIN through screen recording can cost the business millions of rubles—an investment of 30–60 thousand rubles is many times justified. Get a consultation—we will assess your project for free and propose the optimal solution.
Full implementation of screen recording protection on Android + iOS, including App Switcher preview protection and handling of isCaptured state—1–3 days depending on framework and number of sensitive screens. Contact us to start. We guarantee bug-free integration and full support consultation.