Free local scan

What assets does your app ship?

You worked hard to create your content and train your models. IP Vault helps make those assets harder to extract from your app, so shipping the experience does not mean handing over reusable files. Start with a free scan to see what your release contains.

Run your first scan →See the trained-model example

No account or artifact upload. The scan reads your package locally; the CI action downloads the pinned scanner.

Android supported · iOS coming soon

01Inventory a release 02Review the assets that matter to you 03Evaluate protection for one asset

01 / Run

Add a report-only step after your build.

Use your own APK, AAB, IPA, AAR or ZIP. These are scan input formats; the protection integration shown here is Android.

# Add after your existing release build.
- name: Inventory shipped assets
  id: ip
  uses: rev3rse-dev/ipvault-scan-action@d42ecce90445468eba1f05c026103826f215a4b4 # v0.3.0
  with:
    path: app/build/outputs/apk/release/app-release.apk
    fail-on-plaintext: "false"

This example keeps uncatalogued model or firmware candidates from failing the job. Errors and incomplete scans still fail. The action itself defaults to fail-on-plaintext: true; decide on a build gate after you have reviewed the first report.

The job summary lists results; JSON and JUnit report paths are step outputs. No vault credential or extra scan permission is required. Your existing build may need its usual repository permissions.

Action documentation and pinned source →

Run the CLI on your machine

Download CLI 0.3.0 for your platform and check its release checksum and provenance.

ipvault scan app-release.apk --json-out scan.json --markdown-out scan.md

Exit 0: no uncatalogued plaintext model or firmware at the selected confidence. Exit 1: candidates found. Exit 2: error or incomplete scan. Content review items can appear with exit 0.

Use the GitLab CI/CD component

Have the build job publish its package as a job artifact, then name that job in job-needs.

include:
  - component: gitlab.com/rev3rse-dev/ipvault-ci/scan@0.3.0
    inputs:
      path: app/build/outputs/apk/release/app-release.apk
      job-needs: [build-android] # your job that publishes the APK artifact
      fail-on-plaintext: false

Component release and documentation →

02 / Read

One trained model. Two ways to ship it.

Our handwriting-model reference app has a plaintext baseline and an IP Vault build. The same scanner checks both release APKs; the model still produces matching predictions in the protected app.

Trained-model release scan comparison
Build	Plaintext models	Sealed assets	What it means
Baseline APK	1	0	The ordinary model file can be taken from the package.
IP Vault APK	0	1	The model ships sealed; runtime checks separately confirm working predictions.

Both scans completed without skipped entries or limits hit. A passing inventory does not prove every valuable asset is protected. The case study also compares declared model bytes and actual predictions.

Baseline scan JSON · Protected scan JSON · Working model and evidence

Turn a result into a decision.

Model or firmware candidate: establish ownership, whether it is already public, and what reuse would mean for your product.
Content collection: review its value. Bundled images or media are not automatically a security finding.
SDK or public asset: informational. These are excluded from failure counts.
Sealed asset: recognized encrypted format. Use declared-asset release verification and runtime checks to evaluate the integration.

The scanner does not prove ownership, find every proprietary format or test purchase enforcement. It does not encrypt files. See the working lesson-library and FormFit video integrations for content examples.

03 / Evaluate

Choose one asset worth protecting.

Your content library. Your trained model. The data that makes your app useful. Choose the asset you want to keep under your control, and start there.

IP Vault encrypts the selected asset in your build and controls which installations can open it. We agree on the integration and success checks around your app. See the integration guide for Android version, architecture and model-runtime compatibility.

The local scan is free. Hosted protection is early access; guided integration and verification are a separately scoped paid service.

Discuss one asset →Read the integration guide

Start with a description of the asset and runtime. Keep proprietary files in your own environment.