Constants & call protection
Protect both recognizable values and the relationships around them.
Values without an obvious source trail#
String and number protection changes how constants appear in the protected application. This reduces the usefulness of directly scanning an archive for recognizable text and values. Runtime support recovers values as the application uses them; correct recovery is part of the behaviour that must be preserved.
Relationships are valuable information#
Method and constructor references can reveal intent even when names have changed. Indirection changes their representation and resolution, while method-scoped protection connects related transformations. These layers complement execution-level protection rather than standing in for it.
Keep authorization secrets on the server#
A program that must use a value on a customer-controlled machine cannot promise that value will never be observed. Obfuscation is not a secure vault for permanent API credentials. Keep signing keys and authoritative entitlement checks on infrastructure you control.