In general, in one aspect, a method is described that includes monitoring data received from input devices. The received data from the input devices associated with an application is copied when the application is active. The data is converted to user commands. Commands used to update the application are received from the application. The converted user commands are compared to the commands from the application. Mismatching commands are reported to a remote server.