Most vendors protect either the server or the mobile binary. PSecure protects the browser, the mobile binary and the game client from one console and one policy model — so a repackaged Android app and a bot replaying your checkout API are handled by the same team, in the same place.
A bytecode VM with a WebAssembly co-processor runs PSecure checks inside the page. It detects headless browsers, CDP-driven automation and AI agents, guards the DOM and script origins, and seals every protected request so your API can reject anything that did not come from a genuine session — no CAPTCHA for real users.
// Web Shield — @pawmask/psecure (beta, private distribution)import { PSecureClient } from '@pawmask/psecure/client';import { PSecureWebShield, createLockedWebVault } from '@pawmask/psecure/adapters'; const client = new PSecureClient({ serverPublicKey: lease.server_public_key, leaseToken: lease.lease_token,});const shield = new PSecureWebShield(lease.policy.protected_selectors, { allowedScriptOrigins: lease.policy.allowed_script_origins,});// Every protected request carries x-psecure-* sealsconst seal = createLockedWebVault({ client, shield, getLiveDomState });6 / 6 — Supported
6 / 6 — Supported
4 / 6 — Supported
5 / 6 — Supported
6 / 6 — Supported
6 / 6 — Supported
2 / 6 — Supported
6 / 6 — Supported