If it ships as JavaScript or Electron, probably yes. An AI agent can pull your secrets, license checks and inner workings straight out of your build. See how exposed yours is in seconds, then lock it down.
$ reashield scan ./acme-studio REAShield: AI Exposure Score app: ./acme-studio oracle: built-in (install rea-agents for the REA oracle) ███████····················· 26/100 [F] Wide open What an AI agent can still extract: ● Hard-coded credentials and endpoints 1 key · 1 URL ● Named IPC channels / exposed APIs 2 channels · 1 API ● Meaningful symbol names 6 ● Readable business strings 18 ● Source-shaped code (vs bytecode) 100% Sample of what's exposed: keys / credentials: acme-pro-2026-salt-7f3a9c URLs: https://licensing.acme-studio.example/v2/activate IPC channels: license:verify, engine:content-aware-fill exposed APIs (window.*): acmeStudio symbol names: applyContentAwareFill, patchMatch, nearestField, LICENSE_SERVER, SECRET_SALT, verifyLicense → Harden it: reashield harden ./acme-studio
$ reashield harden ./acme-studio Hardening ./acme-studio → ./acme-studio-hardened • IPC channels randomized: 2 (2 files rewritten) • Note: channel names built at runtime (string concatenation, templates) cannot be detected; test the hardened app before shipping. • JS files obfuscated: 6 • Assets copied: 2 • Source maps removed: 0 (0 sourceMappingURL references stripped) Before → After hardening ███████····················· 26/100 before ████████████████████████···· 84/100 after ▲ +58 points Hardened build written to: ./acme-studio-hardened Verify with: reashield scan "./acme-studio-hardened"
This is the CLI's actual output on our sample Electron app (paths shortened).
Built for apps shipped with
What happened when one developer used an AI coding model to re-create Adobe's Creative Cloud, and what it means for apps that ship their code.
Released as free, open-source alternatives under the name ArtCraft, for macOS, Windows, Linux and the browser.
Developer Brandon Thomas publishes open-source re-creations of seven Creative Cloud apps on GitHub, built with Claude.
Described as a clean-room reimplementation: no Adobe code was used. Features were recreated from how the apps behave. The apps are early alpha, far from parity.
That's how techstrong.ai framed it. Adobe had not responded publicly as of mid-October.
Copyright protects code, not features. So AI rebuilding what it can see from the outside is often legal, and no tool can stop it. But Adobe ships compiled native code. JavaScript and Electron apps ship the inside too: license checks, secrets and algorithms sit in a readable archive. That's the part REAShield measures and protects.
Sources: techstrong.ai · Notebookcheck · ProPakistani. Adobe product names are trademarks of Adobe; REAShield is not affiliated with Adobe or ArtCraft.
REAShield measures what an AI reverse-engineering agent feeds on, and hardens each part.
One number for how much of your app an attacker can read, weighted by what matters most.
License keys, API endpoints and tokens sitting in plain sight.
REAShield
acme-pro-••••••-7f3a9clicense.js:3licensing.acme.example/v2/…license.js:2GOOGLE_CLIENT_SECRETauth.js:14The names and wiring that explain how your app works are scrambled, so there's no map to follow.
A shipped .map file hands anyone your original source, comments and all. The scanner flags them and harden removes them.
The GitHub Action re-scores every pull request and fails the build if your score drops below your threshold.
const crypto = require("crypto"); const LICENSE_SERVER = "https://licensing.acme.example/v2/activate"; const SECRET_SALT = "acme-pro-2026-salt-7f3a9c"; function verifyLicense(licenseKey) { const digest = crypto.createHmac("sha256", SECRET_SALT) .update(licenseKey).digest("hex"); if (digest.startsWith("00")) return { tier: "pro" }; return fetch(LICENSE_SERVER, { method: "POST", body: licenseKey }); }
var _0x4b1e=_0x2d5b;(function(_0x3a9f2c,_0x1c77d0){var _0x58e1a4=_0x2d5b,_0x2f0b9e=_0x3a9f2c();while(!![]){try{var _0x4a1d3b=-parseInt(_0x58e1a4(0x1e3))/0x1*(parseInt(_0x58e1a4(0x1d9))/0x2)+parseInt(_0x58e1a4(0x1f0))/0x3;if(_0x4a1d3b===_0x1c77d0)break;else _0x2f0b9e['push'](_0x2f0b9e['shift']());}catch(_0x19c2ab){_0x2f0b9e['push'](_0x2f0b9e['shift']());}}}(_0x57f3,0x6b2d1));function _0x2d5b(_0x4f0d6e,_0x3c1a92){var _0x57f329=_0x57f3();return _0x2d5b=function(_0x2d5b8a,_0x1e0c47){_0x2d5b8a=_0x2d5b8a-0x1d4;var _0x4c9e21=_0x57f329[_0x2d5b8a];return _0x4c9e21;},_0x2d5b(_0x4f0d6e,_0x3c1a92);}…
Measured on our sample Electron app against REA v6.4.0. Hardening raises an attacker's cost. It isn't "AI-proof", and nothing stops someone copying behavior they can see.
Three steps. Your build pipeline doesn't change.
Get your exposure score and see exactly what an AI agent can pull out of your app.
One command locks down what leaked. Re-score to prove the drop.
Add the free GitHub Action so any update that makes your app easier to read is caught before it ships.
npm i -g …/reashield-0.1.0.tgz
reashield scan .
For teams shipping proprietary Electron and JavaScript desktop apps. No account needed. Files are sent over HTTPS, analyzed in memory, then discarded.
or choose it. Only code files are read and sent. .env and other config files never leave your machine.
resources folder (it holds app.asar), or the build output folder.npm run build, then drop the project. Only .next/static (what browsers download) is scored.dist or build folder.About the findings above, not the score. One click is plenty.
One command scrambles the names, hides the secrets and randomizes the IPC channels found above. Then re-scan to see the new score.
npm i -g …/reashield-0.1.0.tgz reashield activate <key>reashield harden ./your-appNot ready yet? Get product updates by email.
REAShield runs as a build step. Nothing added to your app, nothing phoning home.
Runs on your machine or in CI.
Check every pull request and block the ones that make you more exposed.
Show your score in your README and keep yourself honest.
Priced per app, billed monthly. No "contact sales" wall to find out what it costs.
More apps, more seats, or on-prem? Talk to us.
No, and anyone who promises that is overselling. Every transform can be reversed by a determined expert, and nothing stops someone copying behavior they can see. What REAShield does is turn cheap, instant, automated AI analysis into slow, expensive, expert work, and gives you a number that proves it.
No. The free web scanner sends your code files over HTTPS to our server, analyzes them in memory and discards them; only the score goes back to your browser. The CLI runs entirely on your machine.
Yes. The scanner only reads and sends JavaScript/TypeScript-type code files (plus package.json for context); .env files, images, binaries and anything else in the folder never leave your machine. node_modules, .git and test folders are skipped automatically. What is sent goes over HTTPS straight into memory on our server, is analyzed, and is discarded once your score comes back; nothing is written to disk or kept. If you'd rather not send anything over the network at all, run the same scan locally with the CLI instead: reashield scan .
It is designed not to: protections are applied consistently and the hardened build is re-scanned. As with any build step, run your test suite on the hardened build before you ship.
From several areas, weighted by how useful they are to someone cloning your app. Secrets and license logic count the most.
Scanning is free forever: the web scanner, the CLI scan command, your score, full findings and the badge. Hardening is Pro ($39/mo): after you subscribe you get a license key, run reashield activate <key> once, and harden is unlocked. It keeps working offline for 14 days between checks, so CI and air-gapped machines are fine. Cancel anytime and hardening stops at the end of the period.
An open-source tool that connects AI coding agents to reverse-engineering tools, so an agent can analyze shipped apps, including Electron and JavaScript apps. It went viral in October 2026, which is why we measure against it.
Free, no signup, results in seconds. Then harden the gaps with one command.