REAShield: can AI reverse-engineer your app?

Case study

Seven Adobe apps, rebuilt with AI in weeks.

What happened when one developer used an AI coding model to re-create Adobe's Creative Cloud, and what it means for apps that ship their code.

7Adobe apps re-created

PhotoshopIllustratorPremiereLightroomAcrobatAfter EffectsInDesign

Released as free, open-source alternatives under the name ArtCraft, for macOS, Windows, Linux and the browser.

Oct 3, 2026

The release

Developer Brandon Thomas publishes open-source re-creations of seven Creative Cloud apps on GitHub, built with Claude.

How

Rebuilt from the outside

Described as a clean-room reimplementation: no Adobe code was used. Features were recreated from how the apps behave. The apps are early alpha, far from parity.

Reaction

"Software is no longer a moat"

That's how techstrong.ai framed it. Adobe had not responded publicly as of mid-October.

The lesson for your app

Copyright protects code, not features. So AI rebuilding what it can see from the outside is often legal, and no tool can stop it. But Adobe ships compiled native code. JavaScript and Electron apps ship the inside too: license checks, secrets and algorithms sit in a readable archive. That's the part REAShield measures and protects.

Sources: techstrong.ai · Notebookcheck · ProPakistani. Adobe product names are trademarks of Adobe; REAShield is not affiliated with Adobe or ArtCraft.

The product

See exactly what an AI can take. Then take it away.

REAShield measures what an AI reverse-engineering agent feeds on, and hardens each part.

A 0–100 exposure score

One number for how much of your app an attacker can read, weighted by what matters most.

84after hardening · ▲ 58

Secrets & keys

▼ 7 → 0

App internals

▼ 3 → 0

Readable names

9 → 4

Readable text

low

Readable code

▼ 100%

Secret & key detection

License keys, API endpoints and tokens sitting in plain sight.

2 high1 med3 findings

acme-pro-••••••-7f3a9clicense.js:3

High

licensing.acme.example/v2/…license.js:2

High

GOOGLE_CLIENT_SECRETauth.js:14

Med

Your internals, hidden

The names and wiring that explain how your app works are scrambled, so there's no map to follow.

As shippedAfter hardening

Readable→Scrambled

Mapped→Opaque

Obvious intent→No clues

Go further when it matters

For your most sensitive code, remove readable source entirely so there is nothing left to analyze.

Standard

Maximum

100

A CI gate that keeps you hardened

The GitHub Action re-scores every pull request and fails the build if your score drops below your threshold.

Add new license flow #128 MKwants to merge 3 commits into main

✓REAShield / exposure-gate Required84 / 100 ≥ 6041s

✓build / electron (macOS, Windows)2m 10s

✓test / unit58s

✓All checks have passedMerge pull request

✕An earlier commit on this PR failed the gate at 41 / 100: a new license key had landed in license-v2.js.

Before / after

What an AI agent reads, before and after one command.

license.js (as shipped)26 / 100

const crypto = require("crypto");
const LICENSE_SERVER = "https://licensing.acme.example/v2/activate";
const SECRET_SALT = "acme-pro-2026-salt-7f3a9c";

function verifyLicense(licenseKey) {
  const digest = crypto.createHmac("sha256", SECRET_SALT)
    .update(licenseKey).digest("hex");
  if (digest.startsWith("00")) return { tier: "pro" };
  return fetch(LICENSE_SERVER, { method: "POST", body: licenseKey });
}

Readable secret, server URL and function names. An AI maps this instantly.

license.js (after reashield harden)84 / 100

var _0x4b1e=_0x2d5b;(function(_0x3a9f2c,_0x1c77d0){var _0x58e1a4=_0x2d5b,_0x2f0b9e=_0x3a9f2c();while(!![]){try{var _0x4a1d3b=-parseInt(_0x58e1a4(0x1e3))/0x1*(parseInt(_0x58e1a4(0x1d9))/0x2)+parseInt(_0x58e1a4(0x1f0))/0x3;if(_0x4a1d3b===_0x1c77d0)break;else _0x2f0b9e['push'](_0x2f0b9e['shift']());}catch(_0x19c2ab){_0x2f0b9e['push'](_0x2f0b9e['shift']());}}}(_0x57f3,0x6b2d1));function _0x2d5b(_0x4f0d6e,_0x3c1a92){var _0x57f329=_0x57f3();return _0x2d5b=function(_0x2d5b8a,_0x1e0c47){_0x2d5b8a=_0x2d5b8a-0x1d4;var _0x4c9e21=_0x57f329[_0x2d5b8a];return _0x4c9e21;},_0x2d5b(_0x4f0d6e,_0x3c1a92);}…

Secrets hidden, names gone, logic scrambled. Nothing left for an AI to map.

26 F as shipped→84 B hardened→100 A maximum protection

Measured on our sample Electron app against REA v6.4.0. Hardening raises an attacker's cost. It isn't "AI-proof", and nothing stops someone copying behavior they can see.

How it works

Scan. Harden. Keep it that way.

Three steps. Your build pipeline doesn't change.

Scan

Get your exposure score and see exactly what an AI agent can pull out of your app.

Harden Pro

One command locks down what leaked. Re-score to prove the drop.

Gate

Add the GitHub Action so any update that makes your app easier to read is caught before it ships.

Install the CLI npm i -g …/reashield-0.1.0.tgz

Free scanner

Get your exposure score in seconds.

For teams shipping proprietary Electron and JavaScript desktop apps. No account needed. Files are sent over HTTPS, analyzed in memory, then discarded.

reashield.q-axiom.com.au · scanner

Drop your app folder here

or choose it. We only read the code files.

code files only · reads app.asar · skips node_modules · up to 3 MB sampled

Analyzing files…

0/ 100 protected

What an AI agent can still extract

Sample of what's exposed

Harden it and prove the drop

Install the CLI and run one command to lower this score. Leave your email for launch updates and early Pro access.

Shareable badge exposure badge

Fits your pipeline

Drops into the tools you already ship with.

REAShield runs as a build step. Nothing added to your app, nothing phoning home.

⌘

One CLI

Runs on your machine or in CI.

✓

GitHub Action gate

Check every pull request and block the ones that make you more exposed.

◎

Shareable badge

Show your score in your README and keep yourself honest.

Pricing

Start free. Upgrade when you ship.

Priced per app, billed monthly. No "contact sales" wall to find out what it costs.

Free

Try it on your app

Web scanner + CLI scan
Exposure score & badge
Full findings report

Scan your app

Straight answers.

Does this make my app "AI-proof"?

No, and anyone who promises that is overselling. Every transform can be reversed by a determined expert, and nothing stops someone copying behavior they can see. What REAShield does is turn cheap, instant, automated AI analysis into slow, expensive, expert work, and gives you a number that proves it.

Do you store my code?

No. The free web scanner sends your code files over HTTPS to our server, analyzes them in memory and discards them; only the score goes back to your browser. The CLI runs entirely on your machine.

Will hardening break my app?

It is designed not to: protections are applied consistently and the hardened build is re-scanned. As with any build step, run your test suite on the hardened build before you ship.

How is the score calculated?

From several areas, weighted by how useful they are to someone cloning your app. Secrets and license logic count the most.

What's free and what's Pro?

Scanning is free forever: the web scanner, the CLI scan command, your score, full findings and the badge. Hardening is Pro ($39/mo): after you subscribe you get a license key, run reashield activate <key> once, and harden is unlocked. It keeps working offline for 14 days between checks, so CI and air-gapped machines are fine. Cancel anytime and hardening stops at the end of the period.

What's REA?

An open-source tool that connects AI coding agents to reverse-engineering tools, so an agent can analyze shipped apps, including Electron and JavaScript apps. It went viral in October 2026, which is why we measure against it.

Can AI reverse-engineer your app?

Exposure score by build

Recent activity

Seven Adobe apps, rebuilt with AI in weeks.

The release

Rebuilt from the outside

"Software is no longer a moat"

The lesson for your app

See exactly what an AI can take. Then take it away.

A 0–100 exposure score

Secret & key detection

Your internals, hidden

Go further when it matters

A CI gate that keeps you hardened

What an AI agent reads, before and after one command.

Scan. Harden. Keep it that way.

Scan

Harden Pro

Gate

Get your exposure score in seconds.

Drop your app folder here

What an AI agent can still extract

Sample of what's exposed

Harden it and prove the drop

Drops into the tools you already ship with.

One CLI

GitHub Action gate

Shareable badge

Start free. Upgrade when you ship.

Straight answers.

See what an AI can take, before someone else does.