--- title: "Obfuscation and Security Tooling" description: "How Shorebird works with obfuscation and Security Tooling" --- This article is about how Shorebird interacts with obfuscation and security tooling. For other Security-related topics: [Security and Compliance](https://handbook.shorebird.dev/compliance/)Company security policies in our Handbook. [Patch Signing](/code-push/guides/patch-signing)Cryptographically guarantee only you can change your app. ## Obfuscation [Section titled “Obfuscation”](#obfuscation) > Obfuscation (noun): *the action of making something obscure, unclear, or unintelligible.* Obfuscation in software is a mechanism which takes a program and renames internal pieces to hide them and make it harder to understand what the program is doing. For example, if you had a function `placeOrder()`, an obfuscation program might rename all instances of that function to `az5()` as part of compilation to make it harder for someone to “de-compile” and understand what your program was doing. Obfuscation is also sometimes used for hiding internal company details such as upcoming product names e.g. `connectToSecretNewProduct()` in your app. Although “[secret scanning](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning)” may be a more reliable approach for those use-cases since obfuscation tools might not find all the ways in which your company secrets could be encoded in your binary. ## Flutter & Dart built-in obfuscation [Section titled “Flutter & Dart built-in obfuscation”](#flutter--dart-built-in-obfuscation) Flutter (via Dart) supports basic obfuscation out of the box. All you have to do is pass `--obfuscate` to your `flutter build` (or `dart compile`) command. This obfuscation isn’t particularly fancy, but it will rename all library, method and field names in your program to unique identifiers during compilation. ### Using obfuscation with Shorebird [Section titled “Using obfuscation with Shorebird”](#using-obfuscation-with-shorebird) As of Shorebird 1.6.84 with Flutter 3.41.2 and later, Shorebird supports obfuscation on all platforms, including iOS. To use obfuscation, pass `--obfuscate` to your `shorebird release` command: ``` shorebird release android --obfuscate shorebird release ios --obfuscate ``` When you create a patch, Shorebird will automatically detect that the release was built with obfuscation and apply the same obfuscation to the patch. No extra flags are needed: ``` shorebird patch android shorebird patch ios ``` Note Obfuscation support requires Flutter 3.41.2 or later. If you are using an older version of Flutter, `shorebird release --obfuscate` will display an error asking you to upgrade. ## Third party security programs [Section titled “Third party security programs”](#third-party-security-programs) There are a variety of third party security programs for mobile. The vast majority of these work fine with Shorebird. The major consideration when using a 3rd party security program is that it needs to run *during* the build of your application, not after. Under the covers, `shorebird release` mostly calls `flutter build`. When that build is complete, `shorebird release` takes a copy of the built artifact and stores it securely in your Shorebird account. This is done both for your later reference (e.g. so you can access it via `shorebird preview`) but also to make `shorebird patch` possible. `shorebird patch` works by also calling `flutter build` on your newly patched code, but then comparing that output to the saved release artifacts. As a result of this, if you run tools *after* the build of your application and thus send a *different* version of your application to users, Shorebird will be unable to create a compatible patch for your users since they will be using a different binary than you stored with Shorebird. Other than the “it must be during the build” restriction, few issues have been seen with third party security tools and Shorebird. ### GuardSquare on iOS [Section titled “GuardSquare on iOS”](#guardsquare-on-ios) One issue has been seen with GuardSquare on iOS with Shorebird. GuardSquare (at least in some configurations) will make an attempt to “obfuscate” iOS binaries further, replacing the implementations of some functions with code which is used to provide obscured access to constants/strings/numbers stored within the binary. This may be incompatible with Shorebird’s Dart modifications for iOS. If this is an issue for your product, the Shorebird team is happy to discuss with the GuardSquare support team if there are possible workarounds. Reach out at .