The Ground Has Shifted: Uncap Reverse Engineering Liability in Your SaaS Agreement

The ground has shifted, and your liability cap has not caught up. If you sell software or SaaS, take reverse engineering liability out of your limitation of liability entirely: no cap, and no consequential damages waiver, for a customer who reverse engineers your product or misappropriates your IP.

For decades, reverse engineering a real product took skilled engineers, expensive tools, and months of work. That cost was your protection, so a capped claim (usually 12 months of fees) was not too risky. As of this month, that cost is close to zero. I have negotiated a lot of liability caps (after doing 100’s…actually 1,000’s…of deals representing software and SaaS companies), and this one is different. A single GitHub repository changed the math.

What Reverse Engineer Anything Actually Does.

Reverse Engineer Anything (REA) is a free, open-source toolkit released under the MIT license. It plugs AI coding agents like Claude Code and Codex into professional reverse engineering tools: Ghidra (the National Security Agency’s decompiler), IDA, and Hopper. It also handles JavaScript apps, Android apps, websites, and saved browser network traffic.

Its own README says the quiet part out loud: “See a feature in an app that you want in your own product? Ask your agent to investigate it with REA.” The agent explains how the feature works, shows its evidence, and then builds a version for your project.

As of October 18, 2026, the repository had more than 316,000 GitHub stars and 80,000 forks. It has been the top trending project on GitHub this month. The Australian Financial Review ran it alongside ArtCraft, a developer’s AI-built lookalikes of Adobe Photoshop, Illustrator, and Premiere and of Microsoft Word, PowerPoint, and Excel.

Why SaaS Vendors Are Not Safe Behind the Server.

Yea I know, your server code never leaves your servers. But your browser code ships to every user, your API calls are visible, and anyone with a browser can save your network traffic to a file.

Earlier this year a developer named Martin Alderson opened Linear (the project management tool) with his browser’s developer tools running, saved the network traffic, and handed it to Claude Code. In roughly 20 prompts over a couple of evenings, he had a working clone of most of Linear’s core features. His own conclusion is the one that should worry you: most SaaS contracts cap liability at fees paid, so even if the vendor wins, “the damages from a $20/month subscription aren’t exactly a deterrent.”

To be fair, a lot of the viral “I cloned this app in one prompt” demos are hype. But you do not need to lose the whole product. One copied workflow or pricing engine is enough to hurt.

The Law Was Never Going To Save You.

Reverse engineering is generally legal unless a contract says otherwise. The Defend Trade Secrets Act says outright that reverse engineering is not “improper means” (18 U.S.C. § 1839(6)(B)). The Supreme Court in Van Buren v. United States (2021) held that someone with authorized access does not violate the Computer Fraud and Abuse Act just by using that access for an improper purpose, which takes the federal hacking statute off the table for most terms of service violations. And copyright protects code, not functionality. (I covered the copyright side in Reverse Engineering Software.)

So your contract is the protection. Courts generally enforce a no reverse engineering promise. The Federal Circuit did in Bowers v. Baystate (2003), and the Eighth Circuit did in Davidson & Associates v. Jung (2005). (More on what courts enforce in software license restrictions.) The newest case shows exactly why the contract matters. In Applied Systems v. PBC Consulting (N.D. Ill. Aug. 31, 2026), Applied alleged that Comulate, an AI startup, set up a fake insurance agency to license Applied’s Epic software, made millions of calls to the system, and turned off logging to hide it. The court said reverse engineering alone is not improper, but reverse engineering that breaches the license agreement can be. The trade secret claim survived the motion to dismiss because of the contract.

One caution. In New York, Trackman v. GSP Golf (S.D.N.Y. 2024) threw out a no reverse engineering claim as preempted by the Copyright Act, because the “studying and analyzing” was really part of building a copying competitor. Your restriction should prohibit using the service to build or train a competing product, not just copying.

Why the Cap Is Now the Price of Your Clone.

Here is the problem in one sentence. If your agreement caps the customer’s liability at 12 months of fees, then the most a cloner pays you for breaking your no reverse engineering clause is 12 months of fees.

For a self-serve account that might be a few hundred dollars. Your reverse engineering clause is now a price list, and the price is cheap. And it gets worse, because the real harm from a clone is lost profits, which is the textbook example of consequential damages. Most damages waivers name lost profits specifically, so a capped claim can be worth close to nothing.

On my own templates, the cap protects the vendor. The trouble starts with three words in a negotiation: “make it mutual.” I wrote about how a mutual cap backfired on a vendor in the $1.88 million limitation of liability case. Reverse engineering is the same trap with a much bigger number attached.

What To Change Now.

• Uncap it. Take the customer’s  misappropriation of your IP, completely outside the liability cap and outside the consequential damages waiver. Not a super cap. Uncapped.
• Fix your click-through terms first. The cloner is rarely your enterprise customer. It is the free trial or the $20 plan, and those terms often cap liability at $100 or fees paid.
• Update what “reverse engineering” means. Add AI agents, automated analysis, and saving network traffic to the restriction, and prohibit using the service to build or train a competing product.
• Keep the right to an injunction. Money is the backup. Stopping the clone is usually what you want.

If the customer insists that the carve-out be mutual, that is usually fine, as long as it covers misappropriation and infringement of the other party’s IP. For everything else in your SaaS contract, the usual cap still makes sense.

Questions I Get About Reverse Engineering Liability.

Is reverse engineering software illegal? Not by itself. Federal trade secret law treats it as a proper means, and copyright protects code, not how it works. A contract that prohibits it is what makes it a breach.

Will enterprise customers accept uncapped liability for reverse engineering? Many will, and the argument is simple. A customer that has no plans to copy you gives up nothing by agreeing not to, and pushing back on this carve-out tells you something about the customer.

Is a super cap good enough? No. Any number you pick is the price of copying you. The point of uncapping is that there is no price.

Go read your limitation of liability clause today, and the one in your click-through terms. I hope this helps.

Last updated: October 18, 2026.

Resources:

• Limitation of Liability Clause: The One Word That Cost a Vendor $1.88 Million
• Reverse Engineering Software
• Restrictions in Software License Agreements
• Indemnity vs Breach of Contract Claim in a SaaS Terms of Service?

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.