Codename One Launches App Shield to Move Security Decisions Server-Side

Codename One, an open-source framework for building cross-platform apps in Java or Kotlin, has introduced App Shield, an enterprise-grade application-attestation layer. The feature uses Apple App Attest or Google Play Integrity to generate hardware-backed statements, which are verified by the Codename One service and converted into short-lived ES256 tokens. These tokens are then validated by a developer's backend server before any sensitive operation is executed, ensuring that a tampered client app cannot bypass security checks locally. The approach addresses a core vulnerability where security logic running solely on a device can be patched or reverse-engineered by attackers. Codename One says the feature is already in use by several banking customers with high-security requirements.