Gym App QR Check-In Rebuilt with AI

The real lesson is product design: unnecessary engagement mechanics can motivate technically capable users to build an escape hatch.

• –LLMs made reverse engineering accessible to someone attempting it for the first time, but human intuition still steered the investigation.
• –Plaintext logs exposed the most damaging weakness; client-side secrets remain vulnerable on rooted devices.
• –Round-trip crypto tests were misleading because the same implementation errors affected encryption and decryption.
• –Independent validation with WebCrypto, OpenSSL, known vectors, and real QR output prevented false confidence.
• –Forcing a social feed onto a utility workflow created friction without improving the core check-in experience.