Protect Against Tampering & Reverse Engineering

Background: Native [platform] app with [high-value features / paid
content / fraud-sensitive flows / none of these]. Concern: [cloning,
piracy, cheating, API abuse from modified clients].

Use case: Add tampering/reverse-engineering defenses appropriate to my
actual risk—without over-investing in protections that don't hold.

Implementation details:
- Set realistic expectations: client-side protections are speed bumps;
  a determined attacker with the binary will get through. Critical trust
  decisions belong server-side.
- iOS: jailbreak detection signals, anti-debugging, and code-integrity
  checks—and their limits. Android: root detection, the Play Integrity
  API for attestation, and code shrinking/obfuscation (R8) to raise the
  bar.
- Server-side validation/attestation as the real defense (e.g., verify
  integrity tokens, validate receipts server-side per 4.6)
- Decide what's worth doing for my risk level vs wasted effort

Deliverable: A risk-appropriate recommendation: which client-side
defenses are worth adding (with their limits stated), what must be
enforced server-side instead, and what to deliberately skip as
low-value.