> If nothing else, a scanner could at least find out with some reasonable certainty that an app is trying to obfuscate something. Only if the developers did a

> If nothing else, a scanner could at least find out with some reasonable certainty that an app is trying to obfuscate something. Only if the developers did a bad job of hiding it. You can tell a positive from decrypted traffic, but not a negative. It’s a useful first step before putting more effort into reverse engineering, sure. > Reproducible builds of what? Of open-source software. The context was “security best practice”, so anything closed-source is a no-go.