Building Offline-First Security Tools with KMP

One security core, five platforms

For a security tool, drift between platforms is a vulnerability. If the iOS build scores a URL with a different heuristic than the Android build, an attacker only has to find the weaker one. Mehr Guard removes that gap by sharing its whole detection core across Android, iOS, JVM, JS, and WebAssembly with Kotlin Multiplatform (KMP).

What lives in commonMain

The security logic is platform-agnostic and lives once, in shared code:

• ▹Ensemble ML model, logistic regression plus gradient boosting, scoring each URL.
• ▹Heuristics engine, 25+ checks: homograph and punycode look-alikes, brand-impersonation patterns, redirect chains, suspicious TLDs, embedded credentials, and IP-literal hosts.
• ▹Threat-intelligence lists, allow/deny sets, versioned centrally.

Only the thin edges are per-platform, expressed through KMP's expect/actual: file access, the QR-camera bridge, and UI. Auditing the security core means reading one codebase, not five.

Offline by construction

Mehr Guard makes zero network calls. Every score is computed on-device, which is both a privacy guarantee (your browsing history never leaves the phone) and a threat-model decision (no server to compromise, no scan to intercept). The privacy claim is verifiable: a check script asserts zero outbound connections.

The numbers

The built-in red-team suite earns its place next to the F1 number: it holds detection quality steady across refactors, so a change that quietly regresses homograph detection fails the build instead of shipping.