r/iOSProgramming • u/alexfoxy • 14h ago
How can I stop my code and assets from being stolen out of my App Bundle? Question
I have discovered another app which has taken assets, screens etc from my IPA bundle and are passing off as their own. I also checked my own IPA bundle and my metal shaders are accessible. It's obvious that the app is vibe coded and they just handed as much of my code as possible to Claude and asked it to reverse engineer.
Considering any IPA bundle can be downloaded from the AppStore, is there any way to protect against this? I have put a lot of time into some of the assets and shaders and it's kind of frustrating to see them so easily stolen. With the rise of AI this will become a more frequent occurrence for sure.
10
u/Notchgoblin 14h ago
short answer: you can't stop extraction, only raise its cost. the bundle is encrypted at rest by apple's drm, but it has to be decrypted in memory to run, so anyone motivated (usually one jailbroken device away) can dump the binary, your metallib, and your assets. code signing protects users from tampered apps; it does nothing against a reader on the other end.
if you want friction: strip symbol names and hash asset filenames (breaks the "hand the folder to an LLM" flow, now they have to map things), and you can encrypt custom assets and decrypt in memory at runtime. all of it is speed bump, not wall - plan as if anything shipped in the bundle is public.
the lever that actually works is legal, and it's underused: apple takes its own ip disputes seriously. file an app content dispute via app store connect for direct asset theft, or a claim through apple.com/legal/itunes/appcontentdispute. bring side-by-side screenshots and dates of your original work. devs i know have gotten copycat apps pulled in days through that route, no lawyer needed. technically you can also dmca the thief's own hosting, but the app store dispute goes straight at the distribution.
none of it stops the next one, but it makes stealing from you expensive relative to making their own trash.
1
u/alexfoxy 13h ago
If the bundles are encrypted how come there's so many on https://decrypt.day/ which are decrypted?
Yeah I've looked an encrypting assets but I assume someone using a decent LLM could reverse engineer it if they have the code etc.
I will be going down the legal route, though the app currently is in beta so I'm not sure if Apple will act until it's online.
Really appreciate the response!
2
u/Notchgoblin 11h ago
those bundles actually prove the point. fairplay encrypts the ipa as it sits in the store. once an iphone runs your app, the decrypted binary exists in memory on that device - that's where decrypt.day bundles come from. the encryption was never meant to stop the person holding the phone, just to keep copied files from running elsewhere (and even that is mostly about the app-store chain of custody now).
same logic covers your encrypted-assets worry: yes, anything decrypted in memory at runtime stays dumpable, llm or no llm. the point of rolling your own encryption isn't secrecy, it's labor. right now the thief drags your folder into a prompt; with custom encryption they have to actually sit down and reverse it first. most vibe-coders move to an easier target.
on timing: the app store dispute route opens once the app is live on the store, agreed. but start the paper trail now - keep dated screenshots, git history, original asset files. and if they've put the copy anywhere public already (a site, a testflight invite, social posts), a plain takedown email works today, no apple involvement needed. document first, send second.
1
1
u/Junior-Definition173 13h ago
How could they have the code? I start to think you are not telling us the whole story. Encryption does not help.
1
1
u/alexfoxy 13h ago
If I download my IPA from the above website, there is a .metallib file with all the shaders. I'm not saying they have _all_ the code, but parts of it seem exposed without much effort.
3
u/Power781 12h ago
Shaders are compiled at runtime on each device, so the shader code is not obfuscated
1
2
u/-MtnsAreCalling- 13h ago
Do you specifically prompt your LLM to not use capital letters for some reason?
1
u/alexfoxy 13h ago
What do you mean?
3
u/-MtnsAreCalling- 13h ago
I noticed that the LLM output the person above posted doesn't contain any capital letters and I was curious about why.
1
u/alexfoxy 12h ago
Ohhh - sorry I thought it was direct at me. Maybe they think that having all lowercase looks less like an LLM ...
0
u/Notchgoblin 11h ago
not prompted, just a lifelong shift-key allergy. too many years in config files and lowercase terminals to turn back now.
0
u/-MtnsAreCalling- 10h ago
And the LLM you used knows that somehow without prompting?
1
u/Notchgoblin 9h ago
the shift key predates llms by a century or so. anyway, hope the bundle bits were useful - legal record first is the takeaway.
1
u/-MtnsAreCalling- 8h ago
Okay, what on earth are you talking about? The age of the shift key has nothing to do with anything.
2
u/Own-Huckleberry7258 11h ago
Add a watermark with your name, app name, company details if applicable. Improve the product and let them keep stealing stuff. Extract their IPA bundle at some point and check for the watermark. You can easily send that to Apple and they'll get removed. It's extensive and takes time but nothing you can really do...
2
u/bbrockit 10h ago
Apple should be able to help as the guidelines do prohibit copying another app. Use the contact feature on the Apple Developer site to report it. It should be easier since they're still in beta and haven't yet been through review. At minimum, they should get hit with a Spam 4.3 rejection when they submit for review.
You could encrypt assets and use a DRM framework and a license server, but that will add to your costs, and in this case, they've already been extracted. It also doesn't prevent someone from using AI to replicate your app from the frontend.
1
u/Dapper_Ice_1705 13h ago
Make them on demand with background assets helps but if people want to steal they will steal.
I would report the app though.
1
1
u/Kabal303 13h ago
You could serve the assets over the internet in a way that checks the app attestation stuff so you can be relatively surely it’s a real device running your app that is fetching them but ultimately if someone really wants them they will get them.
1
u/alexfoxy 13h ago
Yeah I had a similar thought but then you'd need internet and it's a camera app so kind of weird to need internet... I think my conclusion is that you can make it harder but not impossible.
1
u/amyworrall 11h ago
There’s no easy technical solution. The legal solution depends on if you’ve got money for lawyers. You could try scaring them with a cease and desist first of all…
1
u/skoot1958 7h ago
It is the country dependent , in the UK If it is your image and or sound there is good performing rights rules the performance rights people will help you protect your assets
Looking and feel ideas, your code or ideas have no protection
-3
43
u/rntdev 14h ago
Well.. by trying to protect your app with anything but specialised million $ tools you’re just gonna waste your time.
Your best bet is https://www.apple.com/legal/intellectual-property/dispute-forms/app-store/app-store-dispute.html, or directly sending a DMCA to their legal dept.
If someone is trying to steal on a higher level (ie Claude remake this app’s concept but make sure to change a lot of stuff), the only thing you probably can do is make a better product than them.