Choose a marker that cannot authorize anything
CloneGuard creates a deterministic, domain-separated marker from app and release labels using a private key. The resulting token is intended to be non-secret evidence, not a password, license credential or access capability. Integrate it explicitly as an ordinary resource before native packaging and signing.
Do not change money calculations, entitlements, timing or customer-visible results to create a behavioral trap. Such changes can harm users and complicate compatibility. If behavioral variants are ever studied, keep them in an isolated non-user-facing experiment with its own measurement and review process.
Confirm the release actually carries it
After integration, build and package normally, then scan the finalized authorized artifact. Record the artifact hash, release label, marker registry entry and scanner coverage. A token present in source but stripped by packaging is not evidence about what customers received.
The generic scanner can miss markers that are compressed, encoded, transformed or removed, and it treats some opaque containers as unassessed. A zero-match result in an incomplete scan is inconclusive. Use the required native extraction or packaging tools on an authorized copy when deeper inspection is necessary.
Preserve a specimen before interpreting a match
For an authorized local comparison, keep the exact specimen bytes and hash, acquisition method, collection time and scanner output. Record whether the marker was public before collection and whether common libraries, examples or copied test fixtures could explain its presence. A token copied from documentation has a different interpretation from one confined to a private release.
Avoid repeatedly editing or repackaging the comparison specimen before preserving it. Tooling can add strings, normalize archives or change metadata. A simple chain of recorded transformations helps distinguish the original observation from artifacts introduced during analysis.
Write a narrowly supported finding
A useful finding states that the token was found at a particular location in a particular hashed specimen, with the scan’s coverage and known limitations. It then lists plausible explanations and what additional authorized evidence would distinguish them. Keep ownership and legal judgments outside the scanner report.
Do not automate accusations or takedowns from a marker match. Likewise, absence does not demonstrate independent implementation, since markers are removable. The operational value comes from a disciplined lead that can be investigated, rather than a universal fingerprint of copying or AI use.
Practical checklist
- Use tokens that grant no privileges.
- Integrate before packaging and signing.
- Preserve exact hashed comparison specimens.
- Record public exposure and competing explanations.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.