v0.2 — tiering, configurable alerts, event log

Passive 13.56 MHz reader detector for Flipper Zero. Carry it in a pocket; it alerts you — by vibration first — when a reader interrogates you.

Detects readers, not tags. A card, badge, or fob will never trigger this — passive tags have no transmitter. You need something that emits: a phone with NFC on (unlocked), or a payment/access terminal. Present it to the back of the Flipper.

Install

Download nfc_canary.fap below and copy it to /ext/apps/NFC/ on the SD card (qFlipper's file manager works), then Apps → NFC → NFC Canary.

Built against Unleashed unlshd-089 (API 87.8). If your firmware reports a different API major version, info device will tell you — a mismatch shows as Preload failed: Invalid file, and you'll need to build from source against your SDK. See the README.

Renamed from NFC Alerter

This app was briefly published as "NFC Alerter". If you installed that build, delete the old nfc_alerter.fap from /ext/apps/NFC/ — the new app id means it stores settings and logs separately.

What's in v0.2

• Threat tiering — Info (brief carrier, silent + logged), Warn (sustained), Alarm. Ambient 13.56 MHz is everywhere, so a bare carrier is not an alarm.
• Configurable alerts — vibration and sound each with their own pattern (Off / Single / Double / SOS / Pulse / Constant), tone (1–4 kHz), volume, and per-tier thresholds. Vibration is the primary channel and engages one tier earlier than sound.
• Event log — timestamped, persisted to SD as CSV, with a detail view per event.
• Session summary and a history strip showing the last ~5 minutes at a glance.
• First-run screen explaining the tag-vs-reader distinction.
• Diagnostics screen — live EFD bit, raw edge counter, alarm self-test.

Known gaps

• Decoy mode / protocol fingerprinting is plumbed but not wired up, so protocol and command fields stay blank. Tracked for v0.3.
• Alarm tier currently triggers on a sustained carrier, not on a reader addressing the device by UID — that sharper distinction arrives with Decoy mode.
• Battery figures in docs/VALIDATION.md are datasheet estimates, not bench measurements.

Scope

Defensive only. It detects interrogation aimed at the wearer and reports it. It does not capture, store, clone, or replay credentials — the log records only that an interrogation happened, never card contents.