Start from an explicit specimen
Choose the exact release you want assessed and record its hash. For a browser application, list the JavaScript, CSS, images, WebAssembly and public network responses a normal session receives. For a desktop or mobile application, identify the installer, executable, resources and supported architectures. Source repositories and production releases are different specimens; an analysis of one should never silently become a conclusion about the other.
A mixed product needs multiple rows in this inventory. A Swift client may expose screens and embedded resources while its backend owns pricing authorization. A web dashboard can disclose workflow names without disclosing the server implementation. Write down which valuable decisions are actually present in each delivered component.
Separate three analysis surfaces
Static inspection asks what can be read or extracted from files. Dynamic inspection asks what an application does while running. Behavioral reconstruction asks whether a new implementation can satisfy a useful subset of the same tasks. Progress on any one surface does not automatically establish progress on the other two.
REA has format-specific analysis paths at the pinned revision used in our review. Availability depends on the specimen, provider and local tools. Record which path ran, what it returned and which tools were unavailable. Do not replace a skipped native decoder with a blanket statement that the binary was unreadable.
Choose controls for the exposed decision
If original source maps were included unintentionally, keeping them private removes a convenient implementation aid. If an API returns privileged data to an unauthorized user, the remedy is server authorization. If a public screen reveals a workflow, packaging changes cannot make that workflow unobservable to customers.
CloneGuard can screen supported release bytes and guide native hardening, but it does not establish a boundary around every observation. Prioritize decisions that must remain authoritative, then test that the server owns them even when a client is modified or replaced.
Validate with a bounded task
Define a reconstruction task such as recreating a deterministic pricing function from an authorized fixture. Decide in advance which inputs and outputs count as success. Keep a separate task for reproducing the interface, because a convincing screenshot and a correct function measure different things.
Retain the agent transcript and final behavior-test results. A useful report explains what the analyst learned and what it could not establish, rather than counting only error messages. This makes the review actionable even when the application remains inspectable.
Practical checklist
- Hash the release specimen.
- List static, runtime and behavioral surfaces.
- Record tool availability and skipped providers.
- Test authoritative decisions independently.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.