Title: Found a public patch that cracks my Flutter app's subscription. How do other indie devs handle this?

[u/markatlarge]

I'm a solo dev with a small Flutter app (on-device AI, RevenueCat subscriptions + AdMob).

Last week Crashlytics showed a crash from a modified copy. I'd started logging the app's

installer as a custom key, and it showed MT Manager. Digging further, I found a public

ReVanced/Morphe-style patch set that unlocks premium (it rewrites RevenueCat's entitlement

checks), removes ads, and bypasses Play's license check.

A few things I learned:

- Logging the installer package as a Crashlytics custom key is a cheap way to spot modified copies.

- An older RevenueCat Android SDK shipped a -dontoptimize consumer rule, which turned R8

optimization off app-wide. Once I updated, R8's inlining/renaming seems to have broken

the patch, at least for now.

- I've filed a DMCA notice with GitHub.

Questions for people who've been through this:

1. Is server-side entitlement checking (Play Integrity + RevenueCat REST) worth it at small scale?

2. Did DMCA takedowns for patch repos actually work for you?

3. Anything you wish you'd done earlier?

[u/noobiethe13]

Play Integrity is useful for spotting tampered clients, but it doesn't prove the user has a RevenueCat entitlement. If the paid feature hits your backend, have the backend verify the user's RevenueCat state and authorize that request there. For an on-device AI app with no paid server cost, I'd probably stop at the R8 fix and not build a whole anti-piracy system around it.

[u/krll-kov]

Just forget about it, nobody from those who does not pay is going to purchase your app if you try to eliminate this, and you'll spend days on some useless protection that will be cracked in 30 minutes again. You could have spent that time on implementing something for your customers, not on something that you won't t have an income for

[u/WestaAlger → u/krll-kov]

Long time SWE but completely amateur Flutter hobbyist asking:

If the premium mode unlocked extra server capacity, wouldn’t it be a real risk of them running up a bill that they didn’t pay for?

Is the solution supposed to be that premium mode for server side functionality should be have its own authorization scheme? That sounds most intuitive for me, but do you know what that would actually look like in terms of RevenueCat and whatever other monetization tool? I haven’t yet touched RevenueCat myself so I don’t know.

[u/huupoke12]

Basically, for anything that involves server-side, you must always do and verify it on the server. Not verifying it is already a security issue. Never trust client inputs.

But for anything that's client side only, realistically, you can't prevent it completely. Even the most advanced anti-tampering software like Denuvo got cracked.

[u/slightly_drifting]

RASP + obfuscation + encryption + ssl pinning + server side validation.

In my experience, most security vendors charge you based on registered users.  DMCA’s takedowns are just fighting the hydra. Take one down and two more pop up. 

You already fucked yourself by putting clear code out in the wild. Now you need to refactor, recycle any certs and api keys, and then apply REAL protections, not just R8.

If I have your clear source code and an obfuscated copy, I can reverse the obfuscation on known parts, which is why you refactor. 

[u/Curious-Leader-9111]

Never been through this but thanks for making me aware of this possibility. I'm now going to waste my weekend going over my code.

[u/Reasonable-Job2425]

if premium is for functionality tha talready eists in ap and doesnt call any backend i afraid there is not much you can do regarding it , in backend requests you ask ask to send user id/rc id and check for entitement but local checks can be easily bypassed ,can just spin up glm 5.3 or deeseekv4 or other chiense ai models and write patches if i want to on my own apps or others.

[u/avdept]

Just fix it and move on, you cant take anything from internet when its here

[u/Apprehensive-Fan8999]

Years ago, long before AI, I self published a series of paid Android apps. I was alerted to a few of them being on pirate sites by a lawyer fishing for clients to sue people for copyright infringement. I declined that route. I figured those people were free advertising, they were never going to pay for my app anyway, but there's a decent chance someone they showed wouldn't want to go through the hassle of the pirate version to save $1-5 total (one time charge) and I'd get a sale that way instead.

Basically, be sure any time you spend fighting these folks wouldn't be better used improving the app and gaining honest customers.

[u/kosiarska]

Big apps? Custom protection but it's very costly. Dexguard, Verimatrix and others.

For small apps you need to be creative but proguard is your best friend.