v0.8.1 — correctness and privacy-manifest fixes

v0.8.1 - correctness and privacy-manifest fixes

A patch release fixing two defects introduced with the v0.8.0 signal batch. No new signals, no API
additions, and no change to how collection is configured.

Fixed

Unreadable /proc sources no longer report as "clean" (Android)

magiskAbstractSocketFound, magicMountModulesFound, fridaThreadNamesFound,
fridaInjectorPipeFound, fridaListenerPortFound and suOnPath are derived from reads that SELinux
routinely denies to third-party apps on stock devices — /proc/net/unix, /proc/net/tcp(6),
/proc/self/fd, /proc/self/task, and executing which. In v0.8.0 a denied read was collapsed to
false, so a locked-down (or genuinely compromised but unreadable) device was reported as clean.

These fields are now omitted when their source cannot be read, preserving the SDK's
missing-versus-false contract: "could not read" is a different observation from "read it and found
nothing". Backends must treat an absent field as unknown and must not default it to false.

iOS Lockdown Mode removed - Apple Required-Reason API

lockdownModeEnabled (added in v0.8.0) read the undocumented NSUserDefaults key
LDMGlobalEnabled. NSUserDefaults belongs to an Apple Required-Reason API category, while this
module ships a PrivacyInfo.xcprivacy that deliberately declares an empty
NSPrivacyAccessedAPITypes. Keeping the field would have made the privacy manifest untrue or forced
a CA92.1 declaration, breaking the "declares no Required-Reason API" guarantee that integrators
rely on.

The field is removed from the public contract, the probe catalog, and the iOS provider. This is a
source-compatible removal of an optional field: TypeScript consumers reading it get undefined
(it was optional), and no other field changed.

Compatibility and privacy

• No new signals, dependencies, permissions, JNI/NDK, persistent identifiers, network requests, or
  Apple Required-Reason API declarations. The privacy manifest remains empty by design.
• Backends should re-check any rule that treated the six Android fields above as booleans - they can
  now be absent on perfectly ordinary devices.

Upgrade

npm install react-native-device-risk-signals@0.8.1

For iOS applications, refresh CocoaPods after updating:

cd ios && bundle exec pod install

Anyone on 0.8.0 should upgrade: the omit-instead-of-false fix changes signal semantics in a way that
affects scoring, and the Lockdown Mode removal clears an App Store review risk.