Some apps let you shake your phone to file a bug report. It feels like a playful convenience. It is also a quiet piece of defense, and the design is smarter than it looks.

A shake is a burst of accelerometer data, a real motion in real space from a real device held by a real hand. A script running in a headless environment has no hand and no phone to shake. To fake it convincingly, an attacker has to simulate plausible sensor telemetry, which is a much harder problem than filling out a form.

The best friction is the kind humans do not notice and bots cannot pass.

Shailin Dhar

This matters because bug and support channels are a favorite target for automated junk. Flood a queue with garbage reports and you can bury real signals, waste human triage hours, or probe for weaknesses. Gating that channel behind a physical gesture filters out the low-effort automation for almost no cost to the actual user.

• A human: shakes the phone without a second thought.
• A cheap bot: has no accelerometer to move and no reason to simulate one.
• A sophisticated bot: can spoof sensor data, but now it has to want to badly enough to build that.

That last line is the whole game. Defense is rarely about making an attack impossible. It is about raising the cost of the attack above the value of the target. A shake gesture is a small, elegant tollbooth on a road that used to be free.