Skip to content
Qubitron Security

Application hardening against reverse engineering and tampering

Hardening raises the cost of copying your app until it stops being worth it. We design the layers, implement them with your team and verify them the way an attacker would.

  • Web bundles
  • Android and iOS
  • Desktop and Electron
  • Licensing and payment logic

What it is

Nothing sent to a client can be made unreadable; it can be made slow, expensive and unreliable to read, reuse and modify. Hardening is the set of changes that does that, chosen for your application rather than applied from a template.

We usually start from an exposure audit so the work targets what is actually exposed. Then we implement the changes in your codebase or build pipeline, keep behaviour identical for your users, and re-run the reverse engineering tooling to prove the difference.

What we check

  • Which logic should not be on the client at all, and how to move it server-side without hurting the user experience.
  • Obfuscation of the code that must stay on the client: identifier renaming, control-flow flattening, string encoding and build-to-build variation, applied where it matters and kept away from hot paths.
  • Secrets and endpoints: removing keys from the build, narrowing what the client can call and adding server-side checks behind sensitive calls.
  • Integrity and anti-tamper: detecting modified or repackaged builds and deciding how the app responds.
  • Anti-debugging and runtime protection: making instrumentation, hooking and stepping through the app slow and unrewarding.
  • Build hygiene: source maps, debug symbols, logging, test endpoints and other things that ship by accident.
  • Domain and environment binding for web builds, and watermarking so a lifted build can be traced to its source.

What you receive

  • A hardening design: which layers go where, what they protect against and what they cost in performance and build complexity.
  • Implementation in your codebase or build pipeline, delivered as reviewable changes with tests for behaviour that must not change.
  • A before-and-after verification report: what the reverse engineering tooling recovered before and what it recovers now.
  • Runbook for your team: how the protections work, how to keep them on as the app evolves and what to do when a layer fires.

Typical timeline

3 to 6 weeks

Depends on platforms, build pipeline and how much logic moves server-side. Quoted after a scoping call.

Pricing

Quoted for your app

Discussed on a short call, then a fixed price in writing before anything starts. Request a quote

Who it's for

  • Products whose value is in client-side behaviour: editors, calculators, games, creative tools, trading and analytics interfaces.
  • Apps with licensing, paywalls or paid features that get cracked or cloned.
  • Teams that have an exposure audit or pen test in hand and want the fixes done rather than described.

Next step

Tell us about the app. We discuss scope and price on a short call, then send a fixed quote in writing.

Request a quoteBook a free exposure call

We only test applications you own or are explicitly authorized to test.

How quoting works

  1. Tell us about the app

    Platform, roughly how big it is and what you are worried about. Two minutes on the form.

  2. Scoping call

    A short call with an engineer to agree what is in scope, what is out, and when. Pricing is discussed here.

  3. Written proposal

    A fixed price, timeline, deliverables and rules of engagement in writing. You sign, we schedule.

Common questions

Can hardening make our app impossible to copy?

No, and nobody honest will say it can. Anything that runs on a user's device can eventually be read. Hardening makes reading, reusing and modifying it slow, expensive and unreliable, which is usually enough to make copying not worth it.

Will obfuscation slow our app down?

Heavier transforms only go where valuable logic lives, away from hot paths, and we measure before and after. Behaviour for your users stays the same.

Do you change our code or just advise?

Either. We can hand your team a design, or implement it in your codebase and build pipeline as reviewable changes, then verify it with the same tools attackers use.

Further reading

Often paired with

All services

Next step

Find out what your app gives away. Book a free exposure call.

Thirty minutes with an engineer, not a sales deck. Tell us what you ship; we tell you what we'd look at first and what an audit would involve.

Book a free exposure callRequest an audit

We only test applications you own or are explicitly authorized to test.