The following prompts area classroom redesign example, not raw dialogue development. They do not include app source code, keys, configuration files, or deployment details. For self-study, you can use compliant tools you have access to, or complete tasks on paper. If AI is temporarily unavailable, draw the flow and write acceptance checks first; you do not need to wait for a teacher online. You can also use synthetic examples to discuss in network meetings.
A reusable development path
Define the target and scenario → Set the minimum flow → Create a version with synthetic materials → Perform one task on a device → Note blockers → Revise and retest one item → Ask a voluntary participant to try it → Decide the next step based on evidence.
You can start building prototypes using AI and existing capabilities before finishing a full Android/iOS programming course. You still need to learn specific topics as tasks require: permissions and state, APIs and costs, storage and recovery, authorization and verification. Packaging, signing, installation, and service availability still require actual verification. This case used existing skills; it was not completed instantly from zero knowledge.
Task 1: Get people to speak first
“Help me design a minimal voice recording prototype. Users want to speak slowly and do not want to write an article first. Use fictional daily questions for the demo. Start with only four steps: ask, answer, pause, save. First provide the states and acceptance methods, then generate implementation options. Do not connect real accounts, do not use private recordings, and do not automatically turn on the camera. Mark the permissions, costs, and failure cases that need my confirmation.”
Check: Does the user hear the question first after starting? Does pause actually stop? Can the user retrieve the content after saving? If it fails, does it explain the situation and keep confirmed content?
Task 2: After AI says it is fixed
“Expected: Clicking replay only reads the current question. Actual: The phone has no sound. First distinguish known facts, unknowns, and three testable hypotheses. Provide the minimum reproduction steps and one step to check first. Wait for the result before making changes; do not change multiple modules at once. After fixing, explain how to verify again and write down any remaining risks.”
Do not copy real logs. Logs may contain identifiers or credentials. This exercise practices reproduction, hypotheses, single-variable changes, and retesting. It does not test syntax or framework names.
Task 3: Organize feedback, do not conclude for me
“Here is a fictional trial summary: A was willing to try but did not install; B got stuck on installation; C wanted to change the text but could not find the entry point; D wanted a new topic every day, then found an existing option. Please categorize these into attitude, behavior, blockers, and potential needs. Mark where evidence is insufficient. Propose one observable task for each person for the next round. Do not infer sales, therapeutic effects, or universal user needs.”
Students should discover: The same phrase “add a feature” might actually mean an existing feature is hard to find; praise is not a transaction; and a suggestion does not mean a need is already established.
Product responsibility for data and APIs
| Problem | What students should be able to explain | Case and next steps |
|---|---|---|
| What leaves the phone | Where do recordings, text, and settings go? Who can access them? | Classroom only draws simplified data flows; it does not show real service configurations |
| What is the use of one Key per person | Facilitates authorization, quota management, and cost attribution; whether billing is independent depends on the provider and account settings | Does not automatically guarantee isolation of personal records; registration and allocation must also handle concurrency, out-of-stock situations, and revocation |
| Why you shouldn't treat admin credentials like regular settings | Clients can be analyzed; obfuscation is not the same as confidentiality | Beta convenience leaves residual risks; it cannot be copied as a mature security solution |
| How to make small-scale trials safer | Minimal data, limited permissions, revocable authorization, recovery verification, and exception handling | True isolation requires engineering measures like controlled services, access control, and auditing; the course does not claim these are all solved |
| How to control costs | Call counts, duration, service failures, and who is responsible for the budget? | University groups use educational hypothetical quotas; do not invent supplier quotes; set limits first, then verify |
This course only explains responsibility and methods. It does not provide real backend tables, service configurations, Bot credentials, or extraction methods. Not opening source code is a product release choice; security cannot rely on closed source alone.
Facing stronger analysis and replication tools
As of 2026-10-23, we only read-only checked the repository description and license identifiers; we did not install, run, or test it.
REA official repository ↗: It explains that it can assist in analyzing app behavior, binaries, and runtime processes. Tool capability descriptions do not guarantee successful analysis of specific targets.
replica-skill official repository ↗: It organizes observation, reconstruction, and testing processes as skills; its README explicitly advocates reconstructing functions and flows using your own assets, without copying target code, branding, copy, or content.
Both currently show MIT licenses; still check versions, dependencies, and licenses before specific use.A tool's license and the rights/access authorization of the target app are two different things. Repository slogans are not legal licenses or security guarantees. Class discussions only cover your own or explicitly authorized demo objects; no legal conclusions or reverse engineering training is provided.
Ask four questions before deciding
Do I have the right to access and analyze this object? Am I using methods, licensed components, or content that doesn't belong to me? How do I cite sources and verify results? Even if it looks the same, what are my users, value choices, and responsibilities?
"My core" is not an excuse, nor does it require writing every line of code from scratch. It requires creators to be responsible for direction, sources, verification, what they refuse to do, and the final delivery.