Thư viện · Nền tảng
Why a binary can never keep a shared secret
Everything inside the file you ship can be read. An API key, a password or a decryption key shared by every buyer is a key for everyone. A sound design leaves only public material in the file.
What does not change
Your binary runs on the user's machine, so the user has full control: they can read memory, set breakpoints and copy strings out. Obfuscation buys time; it never turns a secret back into a secret.
What gets embedded by mistake
- Third-party API keys (email, payments, AI)
- Database passwords
- A shared symmetric key used to "decrypt the license"
- A secret signing key used instead of per-device keys
The right shape
- The file holds only the app id and the app's public key. Nothing in it helps forge the server.
- Each device creates its own key pair on first run and keeps it in the OS keystore.
- Anything that needs a secret (paid APIs, valuable computation) happens on the server, after the session is verified.
With ClavisAUH
The SDK needs only the app id and public key. No Embedded Secrets is part of Standard Protection, so there is nothing to turn on, and variables only reach valid sessions.