Right now the #1 trending repo on GitHub is REA
— Reverse Engineer Anything. 335K+ stars. It lets anyone point an AI agent at
your shipped app and rebuild any feature. No source code. One command. It's
already a one-prompt skill inside mainstream AI tools.
The whole internet's reaction has been some version of: "software is dead," "your app is exposed," "every competitor can clone you now."
They're right. And in a week of 100K+ developers rushing to use REA to open other
people's apps, I noticed something: nobody built the defense.
So I did. It's called REAShield — the direct counter to REA. The name says the
whole thing: REA opens apps, REAShield closes yours.
No hand-waving. REAShield ships a harness that runs the actual REA against your
own app, before and after hardening, and scores what it recovers.
On my test app:
Because the secrets weren't obfuscated. They were gone: moved off-device,
sealed as ciphertext, or compiled into WebAssembly REA can't walk.
REA is static — it never runs your app, and it leaves anything
runtime-computed "unresolved." REAShield weaponizes exactly that:
npm i -D reashield
npx reashield build
npx reashield test --rea
Run REA on your app before and after. Watch the recovery number drop to zero. (JS,
Electron, and Python: pip install reashield.)
Offline code is never unbreakable. If a machine runs it, it has it; a determined
human still gets there. REAShield's job is to defeat the automated attack —
the one REA just handed to everyone — and raise a human's cost from minutes to
days.
REA made reverse-engineering a one-command skill. REAShield makes the defense one too.
https://github.com/HMAKT99/reashield — point REA at it and try to break it.