Protections
Class sealing (AuthEngine)
Encrypt whole classes until your program unlocks them.
Setting: authengine.enabled. Requires native protection and Java 17 or newer. This encrypts entire classes — not just strings or names inside them — and keeps them out of the plain jar entirely. At runtime, your program decrypts and loads them using a method you choose.
Setting it up
- Mark each class you want sealed with
@pbco.authengine.Encrypt(see Annotations). - Add an empty static method to your code with the signature
void method(byte[])— flowguard scans your jar and lists the ones it finds as candidates for Unlock method (authengine.method). - Set an Unlock key (
authengine.key) — flowguard stores this in your project file.
The key isn't a secret vault
The unlock key is a local gate, not strong secret storage — it's saved directly in your project file. Don't treat it as protecting something that must never be recovered; it raises the bar for casual inspection, not as a cryptographic guarantee against a determined attacker with the file.
Hidden loading
@pbco.authengine.Encrypt(hidden = true) loads the class in a way that other code can't look up by name afterward. Only use this for classes nothing else refers to by name — otherwise those lookups will fail.