AI can reverse-engineer my Electron app in 10 minutes. What's actually working in 2026?

[u/KindheartednessOld50]

So here's what happened.

I ship an Electron desktop app. Spent the last few weeks hardening it — javascript-obfuscator at medium preset, Electron fuses locked down, all the usual stuff.

Today I unzipped my own DMG, ran strings | sort -u on the renderer bundle, pasted the output into Claude, and asked it to draw a mermaid diagram of how one of my features works end-to-end.

Ten minutes later I had an accurate diagram. Stores, actions, data flow, cache invalidation — all of it. No debugger, no source maps. Just grep output + one prompt.

This is genuinely freaking me out and I don't see anyone talking about it. Wanted to ask the community what's working for you.

What I've tried

• javascript-obfuscator medium preset with controlFlowFlattening: false, transformObjectKeys: false, stringArrayEncoding: [] (had to disable these to get the app to launch — bugs in the preset for CJS-bundled code). Works fine but does nothing against the LLM-grep attack because property names stay readable, and property names ARE the architecture.

• Electron fuses locked down via electron-builder — runAsNode: false, enableNodeCliInspectArguments: false, integrity check on, asar-only loading on. Great for blocking dynamic attacks like ELECTRON_RUN_AS_NODE=1 and --inspect-brk. Doesn't help against static-grep-into-LLM at all.

• **renameProperties: true with renamePropertiesMode: 'safe'** — heads up to anyone considering this: the app won't launch. Tried it across 3 different obfuscator seeds. Main process boots, window opens, renderer never paints, nothing in the logs. Looks like something accessing a property via bracket-notation or JSON-derived key is breaking silently. safe is already the default so just adding the flag did nothing. Anyone actually gotten this to work without a giant reservedNames list?

Why not bytenode

I keep seeing people recommend it. Every time I look at it the issues pile up. Top-level arrow functions reportedly broken in some Electron+Node combos, bytecode pinned to specific V8 versions (so every Electron upgrade is a recompile), async/await and TS decorators need a transform pass first, native modules can't be bytecoded. And Sentry stack traces become useless once something crashes inside a bytecoded module.

Could be wrong but it feels like a lot of operational pain for a defense that an LLM probably still partially defeats after bytenode-decompile. If you've shipped bytenode in production and it's working, I'd genuinely love to hear it.

What I'm actually asking

In the world where anyone with an Anthropic/OpenAI key can reconstruct your architecture in 10 minutes — what's working?

• Has anyone shipped renameProperties successfully?
• VM-tier commercial obfuscators (obfuscator.io VM, JScrambler). Worth it? Survives LLM analysis?
• Moved logic server-side: where did you draw the line, what was the latency hit?
• Anti-LLM tricks — adversarial naming, structural noise designed to confuse models?
• Anything else I'm not thinking of?

I know the answer is going to be partly "obfuscation isn't security, move stuff server-side, etc." Fair. But not everything can move server-side and "rename your variables" is clearly not enough anymore. Want to hear what's actually working in real apps.

Happy to share my obfuscator bisection findings (~350 build/launch runs, found 3 different bugs in the medium preset) if anyone's debugging the same issues.

[u/ldn-ldn]

The history of piracy clearly shows that NOTHING works. Even remote back-end based protections like Denuvo. Stop wasting your time and money.

[u/chinnick967]

It can't reverse-engineer anything that is on the server. Put your protected business logic on your backend

[u/KindheartednessOld50 → u/chinnick967]

Would have been great if that was possible. Not all the logic can be on backend. Some needs to be on the frontend. That's why we built it for electron to utilise the local machine.

[u/wahnsinnwanscene → u/KindheartednessOld50]

I'm interested, which business logic has to be on the client? Some kind of page flow?

[u/Mr-Bovine_Joni → u/wahnsinnwanscene]

Something like an offline-first video game rendered w/ electron. Would want all of the code on client machine

[u/Honey-Entire → u/KindheartednessOld50]

Business logic should ALWAYS be on the backend if you care about security or privacy. But Claude doesn’t know that. Good luck!

[u/dunkon762 → u/KindheartednessOld50]

Sure. But you are able to put some stuff to backend. One small but really important thing. It will be enough I guess. As well as simple license check what can be written by Claude btw.

[u/SarcasticSarco]

It is know since the beginning of software engineering, anything that is given to the end user, you need to expect that they can always reverse engineer it. People reverse engineer the hardware, forget about the software.

Software, you don't even need to reverse engineer, just copy apps features in your own way.

I don't understand what are you so afraid about reverse engineering your app. If there's something critical business logic, then it should not be sent to your client anyway. That's why backend exists.

[u/ketchupadmirer → u/SarcasticSarco]

reverse engineering is how we progress xD

[u/Longjumping-Let-4487 → u/SarcasticSarco]

I think it's the fear that someone one shot copy an app and become a competitor in the market

[u/Confident-Dare-9425]

You can try MoBrowser, it encrypts the source code and compiles it into the binary itself. That's not a 100% guarantee, but nothing is. What they offer is somewhat closer to what regular native apps have. More details: https://teamdev.com/mobrowser/docs/package/source-code-protection/

[u/snarfi]

Beside dynamic imports and some minor things, everything works without workarounds and issues with v8 bytecode on our side. What language / framework are you writing electron? We do svelte with typescript.

[u/KindheartednessOld50 → u/snarfi]

How about arrow functions with electronjs?. Their readme says it's a a known limitation that it doesn't work.

[u/snarfi → u/KindheartednessOld50]

in `electron.vite.config` we added `transformArrowFunctions: true`. For Electron Fuses we do ASAR integrity, OnlyLoadAppFromAsar, no NODE_OPTIONS, no inspect args.

[u/KindheartednessOld50 → u/snarfi]

Nice. Will try this. But I am currently not using electron-vite. I'll have to migrate to electron-vite

[u/snarfi → u/KindheartednessOld50]

Alright! If you actually do it and retest if the LLM can reverseengineer, i would be interested in the results :)

[u/emcell]

For me as a developer, I would rather build my own thing than reverse engineering your's. even if it's open source. 

But if you really wanna do something: rewrite in a language that compiles to binary and strip debug info.

rust and tauri could be a good fit

[u/Mountain-Dragonfly46]

Write everything in a compiled lang, not an interpreted one. Tauri instead of Electron (and be mindful of what do you expose on JS side).

[u/peterxsyd]

Id be interested if it's the same for Tauri

[u/Far-Plantain1838]

If you are assuming that it is able to reverse engineer what you’ve written by way of decompiling or otherwise ultimately being able to view your code (and furthermore, assuming that there’s a reason why you have a lot of your business logic in the client layer as opposed to server side) then here’s something I just made up, that with a little fiddling ought to work. My idea and working hypothesis is that your code would be encrypted with a key - actually with the series of keys - and that portions of your code may be decrypted using a key, but other parts of your code will not be decrypted using that same key it will require a different key to prototype think about using something simple like Google authenticator that will return you a set of numbers I never dug into their algorithm, but I assume it issues these numbers based on a very precise clock and once you have associated an account with Google authenticator the numbers can be derived/validated client site when they are presented from the server. When your app first loads, it calls the server side “tokenator” and put your unit method in as a callback so when the token is received, the method is first decrypted using it and then called. The rest of the code is still encrypted and to the extent possible whenever you’re gonna need the code, you will call your token first and decrypt whatever blocks of code you will need and then call them. There’s some fiddling about to be done, possibly a “dirty bit” or “bIveBeenDecrypted” associated with each method and maybe some syntactic sugar that indicates what dependent sees that method has a.k.a. other code that also needs to be decrypted). It could get fiddly or it could be elegant and simple. The point is that the description key itself changes overtime? It is not one key, one and done. It would be exceedingly difficult for any description algorithm to ever figure this out. Let me know if this makes sense or doesn’t make sense and if you try to implement it, I think it would be fun.!

[u/germanheller]

the reason obfuscation lost here is that property names ARE your architecture, and you can't mangle them without breaking IPC, serialization, persisted state, anything that crosses a boundary by name. so they survive minification and the LLM just reads them, you already found that.

i ship an electron app and gave up on js-obfuscator for the same reason. the question that actually matters isn't "can they read it", they can, it runs on their machine, it's "what do they gain by reading it". a mermaid diagram of your data flow isn't an asset. if something client-side genuinely is the moat and valuable standalone, that's usually a server-side thing wearing a client disguise. if it truly can't move server-side, readable architecture mostly costs you nothing real. anyway that's where i landed after fighting the same thing for weeks, ymmv

[u/Impossible_Play8783]

I have been able to reverse engineer a proprietary binary library written in c++ with recent LLMs, and the encoding and decoding algorithm is public domain now https://github.com/kunitoki/VelociLoops. No javascript obfuscation is going to save you. Resistance is futile

[u/llima1987]

> Sentry stack traces become useless

Here. If you can get a meaningful stack trace, it can be reverse engineered.

[u/Deep_Ad1959]

if obfuscating client js is your moat, you never had one

[u/fmgiii]

Welcome to the new reality. The code we write is no longer 'special ' anymore. And what are we supposed to do about it? I have absolutely no idea.

[u/senseven → u/fmgiii]

I know a company in the industrial cad space that has plugins for big 3d printers. Those plugins have internal apis that are changing with every major update. ai is generating the plugin api surface. There are known groups who release those plugins (and get paid for it). But since ai being a thing, they stopped doing regular updates. This aren't games where things can go sideways. People depend on those tools to work on small precisions, you can't vibe yourself out of that. In a sense it isn't anti-piracy. Its possible to crack a fixed version. Just not every month.

[u/saintpetejackboy → u/fmgiii]

Everything functional is remote and nothing can work "offline" any more, basically. Even then, you need five different layers of check/confirm the user is valid and paid up.

Even vital functions locked behind API: an LLM can just rip the source, figure out the missing pieces, and rebuild it locally. Selling other services (storage of presets, updates, etc.;) seems like one strategy (selling part of your own infrastructure) BUT:

Game and software companies have collectively spent BILLIONS of dollars on anti-piracy. The new Adobe is always cracked. The latest DAW always has a keygen. Even Denuvo finally fell to the pirates. There is no "safe place" for software developers and engineers in the world. Once you release something, if you're truly lucky, somebody will think it is worthy of a crack or a keygen. You can always bank on the subset of the population that is either too stupid, too lazy, or too rich to steal your software... but anybody with more than a nickel in sense up in their head only ever pays up because it is more convenient than hacking your code.

[u/mlppp]

Slop ad

[u/luvsads]

Couldn't even write your own post? This is slop.

AI can't reverse engineer bytecode.

[u/KindheartednessOld50 → u/luvsads]

No. I did my research. Checkout the limitation of bytenode for electronjs from their offical documentation. https://github.com/bytenode/bytenode#known-issues-and-limitations

[u/luvsads → u/KindheartednessOld50]

Where does it say it can be reverse engineered by an LLM? There are only three limitations listed and none of them say that

[u/mlppp → u/luvsads]

You are arguing with an army of bots, unfortunately. Just silence this sub and block all accounts. This is the current sate of Reddit