Library · Fundamentals
Let the server hold the verdict
An if-statement in a binary can be patched to always be true. What cannot be patched is data or computation that only the server hands out, and only to a valid session.
Is patching one branch enough?
If the software asks the server "is the license valid" and then decides on its own, an attacker only has to flip the outcome of that question. Signed answers expose forged replies, but they do not stop someone skipping the check altogether.
Make value something the server gives
- Important configuration or content lives in variables returned only after sign-in.
- Valuable computation runs on the server: the software sends inputs, receives results.
- Third-party keys stay on the server; the software calls through it.
Balance
Not every feature should depend on the network. Pick the few points that matter most and let the rest run offline.
With ClavisAUH
Secret variables only reach valid sessions and can never be read back from the dashboard. Server-Side Enforcement is part of Standard Protection, so variables always require a live session with nothing to turn on.