Security model
Obfuscation increases the difficulty of understanding and reusing application logic, but it does not provide absolute secrecy when an attacker controls the execution environment.
Exposed
Source Available
Attacker has readable source: your Git repository, or a package of plain .py files.
- Every function, constant and comment is readable in seconds.
- Copying the logic into another product is trivial.
- Shipping only .pyc files does not help: bytecode decompiles.
What protects you: Nothing. Keep the repository private, or do not ship source.
Effort raised
Protected Artifact
Attacker has the obfuscated application: protected .py files and the PyArmor runtime, e.g. in an image you shipped.
- No readable source in the files; names and constants are not found as text.
- Learning the logic takes running it, observing it, or serious reverse-engineering work.
- Behaviour is still observable through inputs and outputs.
What protects you: PyArmor is designed for this case. It raises the cost of reading and reusing your code.
Not the boundary
Execution Environment Controlled
Attacker controls the machine or container: shell, filesystem, processes, logs, environment variables, network.
- Code is decoded in memory to run; every value it holds is visible there.
- Secrets passed to the app are readable: environment, files, memory, traffic.
- Expiry and device binding run on a machine the attacker controls.
What protects you: Access control, secrets management, hardening, monitoring: protect the environment itself.
The strongest security boundary is not obfuscation alone. Protect the environment, secrets, identity, deployment, infrastructure, and release pipeline as well.
Layers, and what each one is for
| Control | Protects against |
|---|---|
| PyArmor obfuscation | Casual reading and copying of the code you ship |
| Secrets manager | Leaked API keys, passwords and tokens |
| Identity and access control | Strangers reaching your servers and containers |
| Container hardening | A compromised process doing more damage |
| Dependency and image scanning | Known vulnerabilities in code you did not write |
| Signed artifacts, protected CI | Tampered or unofficial builds |
The evidence for every claim on this page is in the workshop: 07 · Original vs protected and 11 · Security reality check.