With tools like REA, I think the best way to protect your core implementation is to stop shipping it to users and move it to the cloud. Of course, people can still reverse-engineer the APIs and behavior, but they can not reverse-engineer the server-side code itself.
