See what leaks out of your app — and where it shows up.

We tear down your app to find what's exposed, and competitors' apps to find what's been taken.

Get early access See a sample report

For iOS, Android, desktop and web apps.

greet(user.name)

acct = api.get("/v1/balance")render(acct.total)PAY_KEY = "sk_live_••••"

spend.byWeek(acct)fraudScore(tx) → model

tx.render(0)

POST /internal/payouts

tx.render(2)

Good morning

Sam Patel

Total balance

$24,180.52

•••• 4021+$1,240 this month

Send

Request

Cards

SpendingThis week

Recent

Grocery Co.−$62.10

Salary+$4,200

Transit−$89.00

Critical

Live payment key in the app

Found in a competitor's app

Your fraud-scoring model

Strong match

High

Hidden payouts endpoint

Anything that ships inside your app is public.

With AI, reading a shipped app takes minutes, whether it’s mobile, desktop, web or an on-device model. Assume whatever is inside it has already been read.

Secrets get used
A storage key in the app opens every document your customers have uploaded.
Hidden features get found
The instant-loan feature behind a flag is found, and talked about, before you announce it.
Your work gets copied
The recommendation model your team built can turn up inside someone else’s app.

From app to answers in three steps.

Tell us about your app
And if you suspect your work has turned up in someone else’s app, tell us what you’ve seen.
We look at it the way an attacker would
We go through what ships inside the app, the way someone hostile would.
You get a report
What’s exposed, how serious it is, what to fix, and where your work shows up.

Fewer surprises with every release.

Four problems that show up once your app is in other people's hands, and what changes when you know about them first.

Ship without leaking secrets.

Keys, tokens and internal endpoints end up in the builds you ship.

You find them before anyone else does, ranked by severity, each with a clear fix.

Keep your logic yours.

Pricing rules, fraud checks and models ship to the client, where anyone can take them.

You know what a competitor could lift, and decide what belongs on your servers instead.

Know when you've been copied.

You suspect another app shipped your work, but you can't prove it.

Tell us what you suspect. We check, and you get a clear answer: match or no match, with evidence you can act on.

Stay covered as you ship.

A clean audit goes stale with your next release.

Ongoing checks as your app changes, so new leaks don't wait for the next audit.

Early access

What a report looks like

What leaked, how serious it is, how to fix it, and where else it has turned up.

Sample report · Example banking app

1 critical
2 high
1 medium

Exposed in your app

Critical
Test login that works in production
A login meant for testing still works on your live service. Anyone who finds it is in.Still works on your live service.
Fix ready for review
Review and merge
Removed: const qa = "qa-test:test-pass"
Removed: if (input == qa) allow()
Added: ok = await server.check(input)
Added: if (ok) allow()
We prepare the fix. You review and merge.
High
Support tool endpoint open to the internet
Your internal support tool answers anyone who finds its address, no sign-in needed.Open to anyone who finds its address.
FixRequire staff sign-in and take it out of the customer app.Add staff sign-in, remove from app.
High
Loan approval rules run on the phone
Your approval limits can be read from the app, and applications tuned to pass them.Limits can be read and gamed.
FixDecide on your server and send the app only the outcome.Decide on your server, not the phone.
Medium
Fee rules shipped to every customer
Anyone can see exactly where your fee tiers and limits sit.Your fee tiers and limits are visible.
FixServe fees per account at request time instead of bundling them.Serve fees per account on request.

Found elsewhere

Found in another app

Your credit-risk model

Strong match

What matched: The model itself and the settings you tuned for it, not just a similar approach.The model itself and its tuned settings.
What you receive: A side-by-side summary of what is shared, with supporting evidence.A side-by-side summary with evidence.

Get a report like this for your own app.

Join early access

Works alongside hardening and pentests

Hardening makes your app harder to take apart. Pentests check how your systems hold up. We show what still gets out, and whether it has been used elsewhere.

ScrimScrimApp hardeningHardeningManual pentestPentest

The question it answersQuestionWhat still gets out of my app, and has it shown up elsewhere?What leaks, and whereHow hard is my app to take apart?How hard to take apart?How well do my systems hold up against an attack?Do systems hold up?

When it happensWhenEvery releaseEvery releaseBuilt into each releaseBuilt into buildsA scheduled engagementScheduled

Finds your work in other appsIn other appsIf it shows up elsewhere, we compare and report what was copied.

What you get at the endYou getA report of what leaked, where it shows up and how to fix itReport with fixesAn app that is harder to read and copyA harder appA report of weaknesses found in your systemsWeakness report

Scrim doesn’t replace either one. It shows whether they’re working.

For teams whose app is the product.

If your team ships an app to users, in any field, this applies to you.

Fintech
Insurance
Telemedicine
Mobility
E-commerce
Travel
Logistics
Music
Social
Productivity SaaS
IoT and smart home
Energy
HR
Government services
AI products
Sports and fitness

Banking
Health
Gaming
Automotive
Retail
Food delivery
Media and streaming
Education
Dating
Developer tools
Wearables
Real estate
Legal tech
Security tools
On-device AI
Nonprofits

Your app stays yours

We see your product the way few people do. Here is how we treat it.

Confidential by default
What we find stays between you and us.
NDA on request
Want it in writing? We’ll sign one.
Deleted on request
Your app and our findings are deleted when you ask, or after [DATA RETENTION POLICY].
Only what you name
We only look at the apps you point us to.
Your code stays yours
We never share your app with anyone.
No one else’s code
We never hand over anyone else’s code. You get the result, nothing more.

Questions, answered

Is checking a competitor’s app legal?

[TO CONFIRM WITH COUNSEL]

Can you fix what you find?

For many findings, yes. We prepare the fix, you review and merge it.

What do you need from me?

Tell us which app or apps to look at. There are no technical requirements on your side.

Which platforms do you cover?

iOS, Android, desktop, web and on-device AI models.

How do you handle my app and data?

Confidentially. Details are in how we treat your app.

What does it cost?

[PRICING]

When does early access open?

[TIMELINE] Join the early access list and we’ll tell you first.

Find out what your app gives away before someone else does

Join early access and we'll look through your app, then tell you what we found.

What's exposed in your own app, ranked by severity
If you suspect your work is in another app, we check
Fixes prepared for you to review

See what leaks out of your app — and where it shows up.

Anything that ships inside your app is public.

Secrets get used

Hidden features get found

Your work gets copied

From app to answers in three steps.

Tell us about your app

We look at it the way an attacker would

You get a report

Fewer surprises with every release.

Ship without leaking secrets.

Keep your logic yours.

Know when you've been copied.

Stay covered as you ship.

What a report looks like

Exposed in your app

Test login that works in production

Support tool endpoint open to the internet

Loan approval rules run on the phone

Fee rules shipped to every customer

Found elsewhere

Your credit-risk model

Works alongside hardening and pentests

For teams whose app is the product.

Your app stays yours

Confidential by default

NDA on request

Deleted on request

Only what you name

Your code stays yours

No one else’s code

Questions, answered

Find out what your app gives away before someone else does