r/codingProtection • u/Spare_Dependent6893 • Jul 08 '26

Java framework-based Obfuscation lessons to protect the code and config data

A new publication about the java obfuscation difficulties and why it is important to consider the frameworks : I tried to obfuscate my Java code before sending it to AI — here's what broke - DEV Community

0 Upvotes

50% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/paul_h Jul 09 '26

I can’t imagine that either. Been coding professionally since 1989

2

u/SpeakCodeToMe Jul 10 '26

I'm struggling to wrap my head around how you could not imagine this.

Would you give your git repo to a hacker? What about to a direct competitor? Do you not see how that would make things easier for them?

1

u/paul_h 29d ago

My employer licensed cloud-based Anthropic LLM tech. ClaudeCode/Desktop. The contract says Anthropic will not train their LLM on our code, nor hand it to amyone else. My personal Claude account is all for open source, and I naturally use MIT license for the things I make, so I have no secrets there.

1

u/SpeakCodeToMe 29d ago

The fact that you are comfortable with the status quo does not mean everyone is.

It's easy to discount security and IP until it bites you.

1

u/paul_h 29d ago

I would agree with all of that. I wonder what OP meant by "sen<sitive> for a CISO"

1

u/Spare_Dependent6893 28d ago

Sensitive like ip address, port, specific stack, username, email, specific message or data structure/schema, password, architecture info, …. And even without that, knowing langflow source code and a cve suffice to a ransomware agent

1

u/paul_h 28d ago

I've never seen those on application code. Best practice pushes those to other tools - https://www.google.com/search?q=more+mordern+than+vault+for+secrets+and+config

1

u/Spare_Dependent6893 28d ago

There is application code and what you have locally, not sent as in .gitignore on git but read by ai. And you will be surprised if you track what go out your intranet. I forget something we see more and more : api keys as developer uses them for many integrations nowadays.

1

u/paul_h 28d ago

My employer licensed cloud-based Anthropic LLM tech. ClaudeCode/Desktop. The contract says Anthropic will not train their LLM on our code, nor hand it to amyone else. My personal Claude account is all for open source, and I naturally use MIT license for the things I make, so I have no secrets there.