Secrets walk out
API keys, endpoints, tokens, prompts and leftover credentials embedded in a build can be lifted straight out of the binary with standard static tools.
Application hardening for software vendors
Your shipped app is your source code to an attacker.
And AI just made that trivial. An attacker drops your decompiled app into a large language model and gets readable logic, extracted secrets, and the makings of a working clone in minutes. No reverse-engineering expertise required.
Fortifie scans your build for what it gives away, hardens it (Android, native Mac/Windows/Linux, JVM, .NET), and keeps watching after release. Protection raises attacker cost and time. It does not make cracking impossible.
Built for teams that distribute binaries to machines they don't control.
decompiler output
Exposed Unprotected build
class LicenseValidator {
static final String API_KEY =
"ak_prod_9f3a…";
boolean verifySignature(byte[] d)Hardened Fortifie build
class a {
static final String b =
c.d(0x2e, 0x91); // encrypted pool
boolean e(byte[] f)Illustrative example.
The problem
Every copy you distribute is a copy an attacker can take apart.
Once your app leaves your build pipeline, it runs on hardware you don't control. Free, widely available tools turn compiled code back into readable structure in minutes. That is a supply-chain exposure for you, the vendor.
Logic gets reconstructed
Readable class, method and symbol names let an attacker map your proprietary algorithms and rebuild a working picture of how your product works.
Licenses get bypassed
License checks and feature gates can be located and patched. On the Mac, a Pro unlock is often one flipped preference flag or edited prefs file away.
The new threat
AI changed the attack. Your defense has to be live.
Reverse engineering used to be slow, specialist work. That assumption is gone. Large language models read decompiled Android, native, JVM and .NET code, explain what it does, rebuild it, and surface hardcoded keys on demand. The skill barrier dropped to a copy and paste, and the volume of attempts rises with it.
Simple obfuscation alone no longer holds, because a model can often see straight through renaming. Fortifie answers on two layers that work together.
-
Make the artifact hostile to AI analysis
Renaming symbols is not enough. Fortifie's protections are designed so automated and AI-assisted reverse engineering has a harder time reconstructing what the code actually does. Control-flow flattening, string and secret encryption, and optional code virtualization on native targets turn a clean decompile into output that is noisy, incomplete and expensive for a model to rebuild. The easy copy and paste stops working.
-
Defend at runtime, in real time
Fortifie's in-app protection watches for the instrumentation attackers and their tooling rely on (debuggers, Frida, hooks, tampering, rooted and emulated environments), detects it as it happens, responds live, and streams each threat event to your dashboard the moment it fires.
Detection that learns
Fixed rules only catch attacks someone already anticipated. Fortifie's telemetry layer builds a live baseline of how each protected app normally behaves at runtime, then flags novel attack patterns as they emerge: low-and-slow, evasive, and previously unknown attempts that static detectors miss. It runs in real time alongside the hardcoded detectors, not instead of them, and streams each adaptive alert to your Threat Dashboard. Policy can tighten over the air when you baked that in at protect time. Binary changes still need a new signed release.
Validated in internal red-team testing against evasion, baseline-poisoning and spoofing. Thresholds are tuned per deployment on your own telemetry.
How it works
Assess. Protect. Monitor.
-
01
Assess
We scan your shipped build with the same public reverse-engineering tooling an attacker would use and hand you a readable report (Markdown, HTML or JSON) of everything it gives away: leaked prompts, API keys and leftover secrets, license state, readable symbols, and the logic that can be traced.
-
02
Protect
Fortifie hardens the compiled artifact: symbols stripped or renamed, control flow flattened, strings and secrets moved into encrypted pools, native payloads packed behind a hardened loader, and in-app runtime protection added. For indie Mac apps, the paid unlock becomes tamper-evident.
-
03
Monitor
Runtime protection reports each threat event to your private Threat Dashboard as it fires, including adaptive alerts. If a protected app is cracked or cloned, crack canaries tell you. Re-run Assess on each release to confirm protections held and nothing new leaked.
What the scan flags in a shipped Mac app
- Leaked LLM prompts and system instructions
- API keys, tokens and leftover secrets
- License state kept in UserDefaults or flat files
- Unsigned caches the app trusts
- Plaintext license symbols and checks
- Build-path leaks from your machine or CI
- Provenance and rebadge strings
- Other static tells a cracker looks for first
That is what "Request an assessment" means: a report on your own build, before an attacker writes it for you.
Tamper-evident Mac licenses
Most indie Mac apps store "Pro" somewhere a user can edit. With Fortifie, the unlock does not trust that state on its own.
- Flipping a preference flag does not unlock Pro
- Editing the prefs file does not unlock Pro
- Dropping in an unsigned cache does not unlock Pro
- A forged Keychain-shaped item does not unlock Pro
- An honest, signed grant still does
What Fortifie applies
- Symbol stripping and renamingClasses, methods and symbols lose the names that make code easy to navigate.
- Control-flow flatteningReadable branches and loops become a flat dispatch, so recovered logic is far harder to follow or rebuild.
- String and secret encryptionLiteral strings and embedded secrets become encrypted pools with small decrypt stubs, instead of plain text in the binary.
- Code virtualization on native targets (optional)Opt-in, off by default: selected native functions run as bytecode on an embedded virtual machine, hiding their original instructions.
- Tamper-evident license (Mac)Pro unlocks require a signed grant. Edited prefs, flipped flags, unsigned caches and forged items are rejected.
- Runtime defenses (RASP)In-app checks for debuggers, Frida and other instrumentation, hooks, integrity tampering, and rooted or emulated environments, with a response at runtime.
- Crack canariesWhen a protected app is cracked or cloned, you get notified on your dashboard.
- Private Threat DashboardEach customer gets a private, token-gated dashboard that we set up for you. Threat events and adaptive alerts land there as they fire.
- Auto-harden (operator-guided)Assessment plus threat evidence recommend stronger protect settings. It does not invent secrets or silently rewrite your app. New binary defenses still need a signed rebuild.
Platforms
One approach across the platforms you ship.
Android
APK / DEX protect, RASP, Assess
Native
macOS, Windows, Linux: packer and hardened stub, RASP. Mac scan and tamper-evident license.
JVM
Java / JVM bytecode protect and RASP
.NET
Managed assemblies protect and RASP
iOS
Parked for now
Measured results
What standard tools recovered, before and after.
An internal backtest on four test applications we built and own, with secrets planted in each. We attacked unprotected and Fortifie-hardened builds with public reverse-engineering tools: jadx, apktool, radare2, CFR and monodis.
Unprotected builds
18/18
planted secrets recovered by static tools
Hardened builds
0/18
planted secrets recovered by the same tools
- Symbols stripped or renamed in hardened output
- Strings converted to encrypted pools with decrypt stubs
- Runtime defenses tripped when a live debugger was attached (native and JVM)
Get an assessment
Find out what your build gives away.
Tell us what you ship and which platforms. We'll scan your build and send back a readable report of leaked secrets, prompts, license state and other tells, plus the protections we'd recommend. Customers get a private dashboard that we set up for them. There is no self-serve signup.
Email [email protected]
Please don't send credentials, keys or source code by email. We'll agree a secure way to share builds.