Harden the build
Obfuscation and string protection ship in the Client binary. Secrets still stay in KeysDefender — not in JS.
App Security · AppDefender.dev
CodeDefender
Obfuscation, anti-tampering, and anti-analysis for source and binary.
Broader than renaming classes. CodeDefender covers obfuscation, string and control-flow protection, JS/Hermes and native layers, anti-decompilation, Frida/Xposed/LLDB, APK/IPA repackaging, and runtime binary checks. If the build is rebuilt or hooked, the launch score fails.
Obfuscation & string encryption
JS / Hermes / native bridge
Anti-Frida / Xposed / debugger
Signature and integrity checks
Anti-repackaging
Same launch score as AppDefender
What it does
CodeDefender on the launch path
CodeDefender is integrity and anti-analysis for the Client binary — not a rename-only obfuscator. It covers JavaScript, Hermes bytecode, the React Native bridge, and the native Android / iOS layers that AppDefender already scores.
String encryption, control-flow protection, and anti-decompilation raise the cost of static analysis. Runtime checks catch Frida, Xposed, LLDB, and signature mismatch after a repack. If the APK or IPA is rebuilt, the launch score fails before login.
CodeDefender does not replace AppDefender. It feeds the same Detect → Decide → Enforce path. A hooked exam, fee, or UPI build is BLOCK. Super Admin still enables Sandbox first so Makers can prove FAIL paths.
What it scores
Signals this module is built for
- Obfuscation, string encryption, and control-flow protection
- JS / Hermes and native bridge integrity
- Anti-Frida, anti-Xposed, and debugger attach
- APK / IPA signature and packaging checks
- Runtime binary tamper after install
- Repackaged or sideloaded Client builds
How it runs
Detect, decide, enforce
Score at launch
Integrity and hooking sensors run with AppDefender before Client UI. Isolated Android and iOS catalogs do not mix.
Fail closed
A rebuilt or hooked package is BLOCK. The security screen uses the Client app name only.
Operators
Who owns the control
Super Admin
Enables the environment that holds the hardened catalog. Production changes still need two checkers.
Client Admin
Reviews integrity FAILs in ThreatDesk for that Client. Sandbox proof comes before Production.
Other App Security modules
Read the product page, not a copy here
All modules