Start with what ships
Find source maps, exposed credentials and private build artifacts in the release customers receive.
Open-source release security
Expose less.
Release with evidence.
Audit public artifacts, protect private diagnostics, and verify releases across web, Swift, mobile and desktop.
CloneGuard meets REA.
REA is a reverse-engineering agent. Follow a release through audit, staging, inspection and verification. Private files stay out; public code and behavior remain inspectable.
Illustrative workflow. Select a step to inspect it.
A public product.
A smaller footprint.
Your users need the experience. They rarely need your original source, internal debug files or privileged API access.
Use the right boundary
Apply native build controls and server authorization. Preserve signing, accessibility and the behavior people rely on.
Keep a verifiable record
Record release hashes, detect changes and retain scoped markers with clear evidentiary limits.
One workflow.
Respect for every platform.
The audit is language-independent. Hardening follows the build and signing rules of your actual application.
Browser assets and backend boundaries
Ship less implementation.
Keep source maps private, stage a clean public asset tree, and move privileged decisions behind server authorization.
Read the platform guideWhat the workflow covers
- Source-map and credential screening
- Separate staging for loose web assets
- API authorization and quota review
WASM and encrypted client payloads remain inspectable.
Start locally
git clone https://github.com/anishpras/cloneguard.gitMeasured, with limits
A result you can
reproduce yourself.
Our synthetic web fixture goes through audit, public staging and release verification. Every retained byte stays unchanged.
This measures release hygiene. It does not measure an AI agent's ability to recreate your product.
Inspect the benchmarksSynthetic web release4 files
Before staging3
Public release0
High or critical exposure findings
- 2 private files omitted from public output
- Remaining file bytes preserved
- Subsequent modification detected
Different tools.
Clear tradeoffs.
BLA has a broader artifact-transformation engine. CloneGuard starts with release exposure, native workflows and reviewable evidence.
| Where it helps | BLA | CloneGuard |
|---|---|---|
| Artifact changes | Format-specific decoys and analyzer budget payloads | Public release staging and native-toolchain guidance |
| Experiments | In-tree REA probes and estimated cost showcase | Recorded local checks and explicit unassessed surfaces |
| Apple builds | Plist and native artifact payloads | Swift build, ABI, signing and private-symbol workflow |
Understand the exposure.
Choose the right control.
Practical guides to release security, REA and BLA research, and planning for 2027. Concrete checks, primary sources and clear limits.
A source-map release policy that preserves debugging
Keep production source maps useful for incident response while excluding private source from public hosting.
Audit Swift Release settings without breaking your app
Review resolved Swift optimization, stripping and testability settings against the actual Xcode scheme and shipping artifact.
Apply Electron fuses during packaging, before signing
Review optional Electron runtime features and ASAR integrity controls in the supported package-time workflow.
Dependency auditing and release auditing catch different problems
Combine package vulnerability review with checks of the actual files you publish, without treating either as a complete security assessment.
A REA budget hit is not the same as preventing a clone
Interpret analyzer capacity errors, partial inventories and successful reconstruction as separate benchmark outcomes.
A 2027 plan for measuring AI reconstruction resistance
Plan repeated REA reconstruction trials with hidden tests, matched controls and actual usage instead of estimated hours.
Application reviews
Let's look at
what you're shipping.
Get a scoped review of your application, its exposed implementation and the practical controls that fit your stack.
- Release and API exposure assessment
- Prioritized hardening recommendations
- Validation, limitations and next steps
No promise that a public product becomes impossible to copy. No private code or credentials in public issues.
Book an application review.
Choose a time to discuss your app and the scope of a review.
Loads Cal.com here when you choose to book. You can also open it in a new tab.
Before you ship.
Can this make my application impossible to clone?
No. Public behavior can be observed and distributed code can be inspected. CloneGuard helps remove accidental exposure, apply native controls and preserve release evidence.
Does the audit upload my source code?
No. The CLI and skill helper run locally. The helper does not execute inspected code, follow symlinks or call an external service. Your coding agent's own data handling still depends on the agent you use.
Will it rewrite or re-sign my Swift app?
No. The skill guides native build changes before signing. The CLI can screen supported artifacts and hash the final release, but signature validation, device checks and distribution remain native-toolchain tasks.
Is a canary match proof of infringement?
No. A match confirms a token is present. It is one investigation lead, with alternative explanations. Legal conclusions and independently verified provenance require more evidence.