Launched this week
REAShield
Shield your shipped JS from AI reverse-engineering
1 follower
Shield your shipped JS from AI reverse-engineering
1 follower
REA lets an AI agent reverse-engineer your shipped JavaScript or Electron app with no source code. REAShield hardens your build so that automated attack comes back empty: secret logic moves off-device or ships sealed, and what a static agent reads is stripped. Measured against the real REA on a bundled sample app: 6 protected tokens recovered before, 0 after. Not unbreakable: it defeats the automated attack and raises a human analyst's cost. Open source (MIT).
Free
Launch Team
LoomShow, don't just tell with Loom
Promoted
Hey Product Hunt, maker here.
REA lets an AI agent point at your shipped app and rebuild its features from the bundle, with no source code. If you ship JavaScript or Electron, that is worth taking seriously. REAShield is my attempt at the defensive side: it hardens what you ship so that automated attack finds nothing to recover.
Try it on your own build:
npm i -D reashieldnpx reashield build(hardened client plus a generated server skeleton)npx reashield test --rea(runs the real REA on before and after, and scores what it recovers)What it does: relocates secret logic to your server, ships sealed (encrypted) modules, compiles numeric logic to WebAssembly, strips source maps and semantic strings, and adds inert decoys. It also works as an MCP server:
claude mcp add reashield -- npx -y reashield-mcpThe numbers, and their limits: on the one sample app bundled in the repo, REA (rea-agents 6.8.0) recovered 6 protected tokens from the plain build and 0 from the hardened one. webcrack, a dedicated deobfuscator, also recovered 0. Running the real tools caught a real leak in an earlier build (decoys embedded real names), which I fixed. The raw output is committed in
evidence/so you can re-run it rather than trust me. It is one sample app, so please test your own.Honest limits: offline code can never be made unbreakable. If a machine runs it, the machine has it. This defeats the automated attack and raises a human analyst's cost; the only code that is truly unrecoverable is code you don't ship. Relocation needs a backend you secure yourself. A Python front-end exists in the repo but is not published to PyPI.
I would love feedback, especially from the reverse-engineering side: point REA at your own app and tell me what it still pulls out.