Unfortunately, there really isn't a way to do this- One of the fundamental rules in security training is never trust the client. Anything you can write, they

Unfortunately, there really isn't a way to do this- One of the fundamental rules in security training is never trust the client. Anything you can write, they can open. For the most part, it won't even be that hard. Don't waste time obfuscating it.. If it's at all possible, time would be better spent redesigning the infrastructure such that the client never has any data that you don't want the user to have.. The best way to do this is to generalize an API that the backend uses to talk to the front end. Then, modify your client to use this. We do this with Chron X- We have a generic Card game API that we call from our Client.. It's not perfect, but we're actively making design decisions assuming that someday, other clients may connect, with or without our consent and blessing. We may never allow it, but we have to work under the mindset that the hackers can do anything our Flex can. I'd suggest writing a middleware layer, which takes in requests based on a sessionID, and then allows only certain commands to go through, and only certain data to come back. That way, you minimize your exposure.