DEV Community

Arun KT
Arun KT

Posted on

REA reverse-engineers any app. I built REAShield to make it come back empty

#javascript #security #electron #python

Right now the #1 trending repo on GitHub is REA
— Reverse Engineer Anything. 335K+ stars. It lets anyone point an AI agent at
your shipped app and rebuild any feature. No source code. One command. It's
already a one-prompt skill inside mainstream AI tools.

The whole internet's reaction has been some version of: "software is dead,"
"your app is exposed," "every competitor can clone you now."

They're right. And in a week of 100K+ developers rushing to use REA to open other
people's apps, I noticed something: nobody built the defense.

So I did. It's called REAShield — the direct counter to REA. The name says the
whole thing: REA opens apps, REAShield closes yours.

I tested it against REA itself

No hand-waving. REAShield ships a harness that runs the actual REA against your
own app, before and after hardening, and scores what it recovers.

On my test app:

  • REA recovered my protected logic: 6 tokens → 0. Before, REA mapped the secret algorithm and its constants. After REAShield, its reconstruction had none of them.
  • Then the skeptic's move: I ran webcrack (an open-source deobfuscator) on the hardened build. It stripped the obfuscation completely — 1103 changes — and still recovered 0.

Because the secrets weren't obfuscated. They were gone: moved off-device,
sealed as ciphertext, or compiled into WebAssembly REA can't walk.

How it beats REA, specifically

REA is static — it never runs your app, and it leaves anything
runtime-computed "unresolved." REAShield weaponizes exactly that:

  • Don't ship it — relocate secret logic to your server. REA can't read code that isn't in the artifact.
  • Seal it — ship ciphertext, decrypt at runtime with a server-held key.
  • Compute it away — make calls, imports and strings runtime-computed, so REA reports "unresolved" instead of your logic.
  • Poison the map — inert, coherent fake features that lead the agent to confidently explain something that doesn't exist.

Point REA at your own app 

npm i -D reashield
npx reashield build
npx reashield test --rea
Enter fullscreen mode Exit fullscreen mode

Run REA on your app before and after. Watch the recovery number drop to zero. (JS,
Electron, and Python: pip install reashield.)

The honest part — this is the line that makes it credible

Offline code is never unbreakable. If a machine runs it, it has it; a determined
human still gets there. REAShield's job is to defeat the automated attack —
the one REA just handed to everyone — and raise a human's cost from minutes to
days.

REA made reverse-engineering a one-command skill. REAShield makes the defense one too.

https://github.com/HMAKT99/reashield — point REA at it and try to break it.

Top comments (0)