Micrantha laboratory · mobile security

An extra build-specific security layer for mobile applications.

Envuscator applies randomized, layered obfuscation during your build pipeline to produce a unique protected build for every CI execution. The goal is not impossible client-side secrecy, but a practical increase in the cost of reverse engineering while keeping sensitive build operations inside your own infrastructure.

Discuss an integration View public project

Core engine, entitlement, signed-release, and provider-adapter foundations are implemented and executable-qualified on Linux/Android. Production signing, external entitlement-service deployment, public adapter activation, commercial route activation, and native iOS qualification remain explicit release gates. This is the authoritative public product and documentation site; the historical Micrantha hostname serves this same site.

Build-specific outputA unique protected build

Each CI execution can vary generated native output so one successful analysis is less reusable against the next build.

Layered techniquesRandomized obfuscation

Multiple complementary transformations increase effort beyond a single predictable obfuscation pass.

Customer controlledExecution stays in your CI

Source, protected configuration, artifacts, and build logs remain inside customer-managed infrastructure.

Provider neutralOne engine contract

GitHub Actions, GitLab CI/CD, and local execution converge on the same provider-neutral protection model.

Available now

The core runner-local architecture exists; production activation is still gated.

Envuscator has native Android and iOS generation foundations, a provider-neutral immutable engine contract, signed release metadata verification, workload-identity-based entitlement exchange, entitlement-authorized private engine delivery, and shared GitHub/GitLab adapter composition. Current work is release hardening and production qualification, not a hosted customer-build redesign.

Engine

Runner-local native generation

Android and iOS generation remain inside the customer-controlled build boundary. Linux/Android engine execution is qualified on repository-scoped rootless JIT; native iOS qualification remains a separate release gate.

Trust chain

Signed release + short-lived entitlement

Release authenticity and workload authorization are separate: adapters verify signed immutable release metadata, acquire a scoped entitlement, retrieve the exact private engine archive, and verify it again before execution.

Explicit limitation

Defense in depth only

No build-time client protection is perfect. Envuscator raises extraction cost but does not turn shipped values into durable secrets or replace backend authorization, attestation, rotation, or runtime security.

Target v1 architecture · foundation implemented, activation pending

The service licenses the engine. The runner performs the build.

The implemented trust model avoids creating a second sensitive build boundary. Provider adapters authenticate a workload, verify an immutable release, acquire a bounded engine entitlement, retrieve the exact private engine archive from the fixed service authority, and invoke one provider-neutral local engine contract.

01
Provider identity
GitHub OIDC or modern GitLab job identity binds the workload to reviewed provider context. Token-controlled issuer, audience, discovery, and service-origin selection are rejected.
02
Entitlement exchange
The licensing service evaluates normalized grant state and returns a short-lived engine entitlement. Billing-provider identifiers do not enter the signed workload protocol.
03
Verified local engine
The runner verifies signed public release metadata, retrieves the exact entitlement-authorized private archive from the fixed service origin, independently verifies archive identity, and runs locally.
04
Artifact and evidence
The runner receives platform artifacts plus deterministic manifests and normalized evidence while protected configuration, source, private credentials, and build logs remain outside the service.

Customer-controlled boundary

What stays in the runner

Application source and protected configuration
Plaintext temporary material and platform toolchains
Generated artifacts, application binaries, and build logs
Cleanup, retention, application signing, and release policy

Envuscator service boundary

What the service may know

Verified workload identity and licensed project/namespace scope
Privacy-minimized grant, entitlement, and reconciliation state
Requested immutable engine identity and short-lived authorization metadata
No customer configuration, source, generated artifacts, or build logs

Delivery roadmap

The remaining work is qualification and activation around an implemented core.

Hardening

Engine verification gates

Linux/Android rootless JIT execution is green. Static-analysis and Android sample-consumer gates are being repaired; native iOS qualification remains separate.

Activation gated

Provider adapters

The shared GitHub OIDC and GitLab ID-token authorized paths are implemented internally. Public Action/Component wiring stays disabled until production service and release-trust gates pass.

Implemented foundation

Signed distribution

Immutable archive, checksum, signed release statement, verifier, metadata export, trust-candidate tooling, and adapter verification exist. The first real production offline signing identity and public trust are still pending.

In progress

Commercial authority

Provider-neutral grants, replay-safe event persistence, commercial source bindings, lifecycle mapping, and durable reconciliation exist. Authoritative Stripe network reconciliation, acquisition binding, and production route activation remain.

Planned

Layered expansion

Additional composable build-specific techniques, ABI/toolchain compatibility evidence, broader property/fuzz coverage, and runtime-hooking documentation extend the existing protection model.

Planned

Rust orchestration

Rust remains an incremental migration behind stable contracts and conformance tests, not a prerequisite for the first supported v1 release.

In progress

Public verification

This repository is the authoritative public documentation and signed-metadata surface. Remaining work includes one final public deployment, security/compatibility guidance, quickstarts, and production release metadata after signing trust is provisioned.

Defense in depth

No client-side protection is perfect.

Given sufficient time and resources, a determined attacker can recover values and behavior from a shipped application. Envuscator does not promise permanent client-side secrecy. It increases reverse-engineering cost by producing build-specific native output and combining complementary obfuscation techniques. It complements, rather than replaces, secure backend authorization, secret rotation, hardware-backed key storage, platform attestation, runtime integrity, and a secure SDLC.

Licensing philosophy

Simple, sustainable licensing without unnecessary lock-in.

The intended pricing model includes a perpetual one-time purchase option alongside recurring plans. Provider-neutral commercial grant and reconciliation foundations are implemented, but checkout, production billing reconciliation, public wrappers, and product tiers are not yet presented as generally available. Paid local/offline licensing is a separate later contract rather than a weaker fallback from CI identity.