Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 1–12 of 256

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Alert Delivery and Acknowledgement?

Every failure this series has measured ends in a wrong answer. This one does not. Renaming the distribution list delivered an operational limitation to nobody while both caller-supplied guards passed and the flight dispatched. Measured on both targets, with a purpose-built control.

Read article ›
Entitlement And Licensing · New 2026-08-17 ~10 min read

Does obfuscation break plan entitlement checks?

Measured: two fields written by the same line of code failed in opposite directions, because one was read by our own function and one by an installed library. A forged licence was accepted, and a genuine one read from a file was refused.

Read article ›
Account Recovery · New 2026-08-17 ~10 min read

Does obfuscation break account recovery options?

Measured: renaming one option name made a spent password-reset link work again, and renaming a timestamp field routed the request around the token comparison entirely, so a wrong token was accepted. Protection alone was clean on all five profiles.

Read article ›
Data Lifecycle · New 2026-08-17 ~10 min read

Does obfuscation break data retention policies?

Measured: renaming one option name widened a nightly purge from one collection to every collection, destroying statutory invoices and the audit trail. Renaming a second name alongside it made the damage vanish - which is why a clean combined result proves nothing about its halves.

Read article ›
Fraud Prevention · New 2026-08-17 ~10 min read

Does obfuscation break risk scoring rules?

Measured: renaming a weight field did not zero the fraud score, it made the score not-a-number - and every threshold comparison against not-a-number is false, so a card-testing order scored 75 was allowed. Renaming a polarity flag blocked a four-year customer instead.

Read article ›
Privileged Access · New 2026-08-17 ~10 min read

Does obfuscation break support impersonation controls?

Measured: a full customer-database export was guarded three separate ways, and each guard lost alone still refused it - only the reason changed. One pattern reached all three and the export went through, written into the audit trail as a normal support action.

Read article ›
Audit Evidence · New 2026-08-17 ~10 min read

Does obfuscation break audit log integrity?

Measured: renaming one option name switched off the hash chain, so a deleted row went undetected and the trail still reported itself intact. Renaming a field name wrote a full card number into the trail. The chain checks themselves failed closed, which is the good news.

Read article ›
Bot Defence · New 2026-08-17 ~10 min read

Does obfuscation break bot and CAPTCHA verification?

Measured: renaming one option name accepted a CAPTCHA token solved on the attacker's own domain. Another let one paid solve unlock five logins instead of one. A third turned an unreachable challenge service from an outage into an open door. Protection alone was clean on all five profiles.

Read article ›
Privacy · New 2026-08-17 ~10 min read

Does obfuscation break session replay masking?

Measured: two masking rules deliberately covered the same card field, and each one alone was harmless. One pattern reached both and put a full card number on a replay vendor's servers. A separate arm defeated the password mask the recorder will not let you switch off. Protection alone was clean on all five profiles.

Read article ›
AI Agents · New 2026-08-17 ~10 min read

Does obfuscation break AI agent tool permissions?

Measured: an allowlist of callable tools and a denylist of tools needing human approval sat side by side on one options object. One pattern reached both. Both unread options failed open: an unlisted tool became callable and a refund requiring human approval executed unattended. Protection alone was clean on all five profiles.

Read article ›
Access Control · New 2026-08-17 ~10 min read

Does obfuscation break geo and IP access rules?

Measured: a sanctioned country was covered by both a denylist and a serving allowlist, and losing either alone only changed the log line. One pattern reached both and the sanctioned request was permitted. A separate arm let an address the geo database had never seen in by default. Protection alone was clean on all five profiles.

Read article ›
Measurement · New 2026-08-17 ~10 min read

Does obfuscation break callback result objects?

Measured across six areas: when you hand a library your own guard function, the shape of what it returns is part of the contract too. Rename those result fields and the guard still runs, still decides correctly, and its answer is discarded. Four of six failed closed and loudly. The one that failed open was the one whose flag meant deny rather than allow.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators