Cal I received a notification from Hypatia indicating that it has detected a possible virus in WhatsApp. It wasn’t a scan but a real‑time detection.
Antivirus apps can't scan app-private data, or stop data from entering an app based on its content. Antivirus apps can't scan the memory or network traffic of apps. The only way to try and stop exploits against an app is using GrapheneOS's per-app settings.
This is most likely a false positive, but even if not, it's most likely useless info still. There's nothing you can do to secure WhatsApp other than either stop using WhatsApp, tightening down WhatsApp settings, or enabling OS features like GrapheneOS's per-app exploit protections on WhatsApp.
Cal I had several crashes in WhatsApp a few months ago
signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr (.....) threadName: com.whatsapp MTE: enabled
WhatsApp's legitimate code is well known to be triggering GrapheneOS's per-app exploit mitigations, such as memory tagging, because it's so shitty and irresponsibly written. I suggest you keep memory tagging enabled on WhatsApp if you can suffer through these crashes and silence the notifications for it, or disable memory tagging on WhatsApp if it's insufferable.
dhhdjbd (pretty sure i mostly heard that they are scams on android)
Antivirus apps can scan the contents of the installed apps (APKs): all their native code, Dalvik bytecode, included assets, etc. I wouldn't say they're a scam, but there's a lot of legitimate criticism about them.
Cal Yeah I know, they give you a false sensation of security.
Antivirus wouldn't give you a false sense of security once you understand that it's in no way a replacement for GrapheneOS's sandboxing, permissions, exploit mitigations, etc. :) You control your own thoughts, after all.
Cal Knowing that I have installed hypatia, a offline clamav style open source app, with the extended data base and I am aware that having a scanner doesn't mind I am protected anyway. It's just another precaution.
Do you have Google Play Store installed? If yes, you can just use Google Play Protect which is already included in it, and it probably has much fewer false positives than the app you use. It doesn't scan files though, only installed apps. You can disable its improve harmful app detection setting if you don't want it to upload unrecognized apps from your device.
Cal Should I be worried?
I suggest you to check my tips for WhatsApp here:
https://discuss.grapheneos.org/d/29977-privacy-in-the-messenger/23