Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break WebAssembly Interop?
A WebAssembly module compiled, instantiated, called its imported callback and returned the same value in all five configurations. The break is member renaming reaching the import object, whose keys are strings compiled into a binary the JavaScript obfuscator never opens.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Error Cause Chains?
Error cause chains, AggregateError and the walk a crash reporter does over them measured identical in all five configurations. Member renaming breaks them two ways, and the quieter one leaves your reporter shipping the word undefined instead of a message.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break toSorted, with and the New Array Methods?
The non-mutating array methods and Object.groupBy measured identical in all five configurations, including non-mutation and comparator stability. The measured curiosity is that arr.with survives member renaming while arr.at does not, and the reason is that with is a reserved word.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Tagged Templates?
Tagged templates keep the per-call-site caching and the frozen strings array that css-in-js, lit-html and graphql-tag memoise on, measured across five configurations. The breaks are member renaming reaching strings.raw or length, and both are loud.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break UMD and module wrappers?
A UMD wrapper picked the same branch before and after protection in all five configurations, including the AMD and global-fallback paths. Letting member renaming match exports turns module.exports into a generated name and ships a package that exports nothing without throwing.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break duck typing and capability checks?
Code that decides what an object is by asking which members it has measured identical in five configurations. Member renaming breaks it two measured ways: a real promise stops being recognised as thenable, and a validator driven by a list of required names reports every field missing.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break streams and backpressure?
Reader loops, transform streams and cancellation measured identical against node's real WHATWG streams. Member renaming reaching the underlying-source callbacks produces the quietest failure on this site: no chunks, no output, no error and a successful exit.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break undefined and optional reads?
Absent, undefined and null stayed distinguishable in all five configurations, along with void 0, an array hole and a local that shadows undefined. The one measured break is an optional read addressed by a string key while member renaming rewrites the declaration.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Function.name and reflection?
Identifier renaming changes fn.name, constructor.name and the parameter names readable through Function.prototype.toString, while arity and the native-code marker survive. Name-keyed registries and implicit dependency injection are the two patterns that break.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Web Crypto?
Digests, HMAC signing and an AES-GCM round trip measured byte-identical against a real WebCrypto implementation in five configurations. The one way to break it is pointing member renaming at the algorithm dictionary or the SubtleCrypto method names.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break data-* attributes and dataset?
Attribute reads, the dataset camelCase bridge, selector strings and class lists all measured identical. Member renaming reaching a dataset key detaches your JavaScript from your HTML silently, producing undefined, NaN and false rather than an error.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break eval and new Function?
The Function constructor, indirect eval and string-built helpers behave identically, and their source text passes through unprotected. Direct eval that reads a renamed local stops resolving, which is the one measured break.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break date and time handling?
ISO round trips, epoch arithmetic, UTC field access, month and day normalisation, leap years and fixed-locale formatting all measured identical. The surprises in this area belong to the Date API, and protection preserves them faithfully.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Promise.all and Promise.race?
All four combinators, thenable adoption, AbortController and microtask ordering measured identical. The real hazard is member renaming reaching then, status, value or reason, which we measured breaking hard.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break try, catch and finally?
The finally return-override rule, rethrow identity, nested handler ordering, per-iteration finally with break and continue, and optional catch binding all measured identical on both targets.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break client-side routing?
Pattern compilation, parameter extraction, query parsing, history navigation and guards measured identical. Route strings are data, which is also why protection does not hide your route table.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation change evaluation order?
Argument order, postfix and prefix increment, compound assignment, the comma operator, short-circuiting and getter side effects all measured byte-identical. The sample was built to expose reordering and found none.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break your event emitter?
An emitter with on, off, once and emit measured identical, including with its own API renamed. Event names are strings and survive; the boundary to watch is a bus shared across separately protected bundles.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break URL and query string building?
URL, URLSearchParams, encodeURIComponent and relative resolution measured identical, including under the string table. What protection does not do is hide the endpoints your bundle calls.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break emoji and code points?
String length in code units, surrogate pairs, normalization, code-point iteration and the regexp u flag all measured identical. The bugs in this area are in the original code and are preserved faithfully.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break number formatting?
toFixed, toPrecision, toString with a radix, parseInt and parseFloat all measured byte-identical after protection, including the rounding cases that look like bugs. The only way to break them is a member pattern matching a built-in name.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break modern string methods?
replaceAll, padStart, trimStart, at and split with a limit measured identical, including under the string table that moves and encodes every literal. String identity and immutability hold too.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break type coercion?
Coercion, loose equality, truthiness and wrapper objects all measured unchanged. But renaming a member called valueOf or toString silently disables the protocol and yields [object Object] with nothing thrown.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break math and floating point?
Math methods, floating point results, 32-bit bitwise operators and a hand-written FNV-1a hash all measured byte-identical, and unparenthesised mixed-precedence expressions kept their values.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break frozen and sealed objects?
Object.freeze, Object.seal and property attributes measured identical after protection. The one shape that quietly changes is a property defined by string with defineProperty and then read by dot access under member renaming.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break closures and scope?
Closures, the module pattern, shadowing and loop capture all came through identical, including the per-iteration binding let gives in a loop on the ES5 target. Renaming is scope-aware, which is why.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break the arguments object and rest parameters?
The arguments object, rest parameters and spread at call sites measured identical, because almost nothing in variadic code is a name. One number does move: Function.length on the ES5 target.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break recursion?
Direct and mutual recursion, named function expressions and memoised recursive closures all measured identical, and stack depth headroom was measured rather than assumed.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break typed arrays and binary data?
Typed arrays, ArrayBuffer views and DataView endianness measured identical after protection, because binary code is built from index access and numeric arguments rather than from names.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break Map and Set?
Map, Set, WeakMap and structuredClone come through unchanged, including object identity as a key and insertion order, because a collection key is a value at run time rather than a name in the source.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break JSON serialization?
JSON.stringify and JSON.parse behave identically after protection, hooks included. The two ways member renaming does change your payloads are specific, silent and measured here.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break prototype chains?
Delegation, shadowing and instanceof all survive renaming because both ends of a lookup are rewritten together. Where a rename shows up is reflection by string, which names a property the transform never rewrote.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break JavaScript symbols?
Symbol-keyed properties and the well-known symbol protocols come through protection unchanged, because a symbol key is always a computed access and computed access is not one of the three places member renaming rewrites a name.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break this binding?
Renaming identifiers cannot move a receiver, because this is fixed by the shape of the call site rather than by any name. Methods, arrows, call, apply and bind all measured identical after protection.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break switch statements and string comparison?
The string table replaces literals with calls that return the same primitive strings, so strict equality, switch matching and fallthrough keep working. Measured with MoveStrings and EncodeStrings enabled.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break sparse arrays and sort order?
Array holes stay holes, sort stays stable, and length keeps truncating, because array shape is runtime state that the transforms have no syntax to reach.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break getters and setters?
Accessor properties come through protection intact: the getter still computes, the setter still runs its side effect, and the property descriptor still reports enumerable. The one thing that moves is the accessor name.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation change object key order?
Key enumeration order is a specified property of JavaScript objects, and protection preserves it exactly: integer-like keys first, then string keys in insertion order, with Object.keys, for...in and JSON.stringify all agreeing.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break modern JavaScript operators?
Logical assignment, exponentiation, numeric separators and optional catch binding all come through with identical behaviour on both target versions, including the ES5 path that rewrites several of them into older syntax.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break async and await?
Async functions keep their exact ordering through protection: synchronous code still runs first, microtasks still run in the right place, and a rejected promise is still caught by the try/catch around it.
Read article ›
What survives · New
2026-08-15
~10 min read
Your regular expressions are not obfuscated
A regular expression literal comes out of protection byte for byte identical to the way you wrote it. Named capture groups, lookbehind and Unicode property escapes are all still there in the shipped bundle.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break BigInt and large integer IDs?
BigInt literals, hex BigInt literals and values built with BigInt() all survive protection unchanged. The real hazard with large identifiers was already in your source before you protected anything.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break labeled statements?
Labels and their break and continue targets survive protection in both output targets, including through the rewrite that changes the shape of the loop they label.
Read article ›
What survives · New
2026-08-15
~10 min read
What JavaScript obfuscation does not rename
An inventory of the things that come out of protection with their original text intact: regex literals, import specifiers, bracket-access keys, label names, private member names and exported names.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Proxy, Reflect and defineProperty?
Member renaming rewrites dotted access and object-literal keys. It never rewrites a property name you hand to an API as a string, and that one asymmetry explains every metaprogramming failure people report.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break cross-tab messaging?
BroadcastChannel, SharedWorker and Web Locks coordinate several tabs of the same app. Two of the three carry property names between contexts, and the tabs are not always running the same build.
Read article ›
Diagnostics · New
2026-08-15
~10 min read
Profiling and memory leaks in obfuscated JavaScript
Symbolication restores a stack trace. It does not restore a heap snapshot or a CPU profile, because those read names out of live objects rather than out of an error, and no mapping file is consulted.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break class private fields?
A private name is not a property name, and the engine has to treat it as its own kind of thing. Why hash-prefixed members are skipped by the member transform, why they stop a class being downlevelled, and the one class-field case that used to fail silently.
Read article ›
Browser Platform · New
2026-08-15
~10 min read
Obfuscation and Permissions-Policy
Permissions-Policy is a header, so nothing in your bundle can edit it and an attacker holding your code cannot grant themselves a capability. It is also a common cause of failures that get blamed on the obfuscator.
Read article ›
Third-Party Scripts · New
2026-08-15
~10 min read
Obfuscation and cross-site cookie access
If your script runs on other people's pages, its cookie access is a functional dependency that browsers are steadily restricting. Obfuscation neither helps nor hinders the migration, but it does change how you debug it.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break audio and paint worklets?
A worklet does not run in the window, and the runtime guards notice. Three of them behave three different ways in a worklet scope: one removes your only diagnostics, one silently installs nothing, and one fires its failure action on every legitimate load.
Read article ›
Modules · New
2026-08-15
~10 min read
Obfuscation and import maps
An import map is JSON in your HTML, so no build step touches it and it stays as readable as you wrote it. Why module specifiers survive protection structurally, and what the map itself discloses about your module graph.
Read article ›
Threat Model · New
2026-08-15
~10 min read
Obfuscation and short-lived access tokens
An API key and an access token are different objects, and advice that fits one fits the other badly. What actually bounds a token is lifetime, rotation and sender-constraining, none of which a build step provides.
Read article ›
Compliance · New
2026-08-15
~9 min read
Obfuscation, export control and the encryption question
A transform that ships its decoder alongside the data withholds nothing, so it is not a cipher. Where real signing appears, and how a marketing word creates a classification problem.
Read article ›
Threat Model · New
2026-08-15
~9 min read
Can attackers diff your releases to find the fix?
Ship a client-side fix and both versions of the file are public. What per-build polymorphic output does to that comparison, the four workflows that want a fixed seed instead, and why the diff was never the only route.
Read article ›
Integration · New
2026-08-15
~9 min read
Your postMessage protocol is a public API
A message contract between your page and an embedded frame is a wire protocol anyone can watch and write to. The rename trap that breaks message keys silently, and the origin checks that are the actual control.
Read article ›
Build · New
2026-08-15
~9 min read
Your security scanner cannot read your protected bundle
Static analysis follows names and string values, and the transform removes both. Which of your three scanner families actually cares, and the build order that keeps each one honest.
Read article ›
Performance · New
2026-08-15
~10 min read
What runtime defense costs on the main thread
The transforms are cheap and the guards are not. The timer inventory at shipped defaults, why two wrappers forfeit cached compilation, and the verification that runs on every call into your bundle.
Read article ›
Threat model · New
2026-08-15
~8 min read
Your WebRTC credentials are in your bundle
A WebRTC client has to present TURN credentials to open a relay session, so a static credential in the bundle is a working, billable relay account. What protection changes, and the ephemeral pattern that fixes it.
Read article ›
Threat model · New
2026-08-15
~9 min read
Your random numbers run on their machine
A value generated in the browser is a value the user obtained first. Why crypto.getRandomValues fixes generator quality but not authority, and which draws have to move to the server.
Read article ›
Deployment · New
2026-08-15
~8 min read
Protected JavaScript behind a corporate proxy
In enterprise networks a TLS-inspecting appliance decrypts, scores and sometimes rewrites your bundle before the browser sees it. Why breakage is confined to one customer, and how to prove it with a digest.
Read article ›
Runtime Defense · New
2026-08-15
~9 min read
Your debug-protection timer fires on a backgrounded tab
The debugger-pause check measures the gap between timer ticks, and a browser throttling a hidden tab produces the same gap. The arithmetic behind the defaults, and how to tune it so it reports instead of breaking the page.
Read article ›
Compatibility · New
2026-08-15
~8 min read
Does obfuscation break cross-origin isolation?
Isolation is decided by response headers, which a code transform never emits. The real intersections are the hidden frame two runtime wrappers use for untampered built-ins, cross-origin delivery, and one timing check that is unaffected.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Can you lock JavaScript to a device?
Domain, browser and operating-system locks read values the client volunteered about itself, and two of them only compare two self-reported strings. What the guards do, why they fail rather than skip, and what binding actually requires.
Read article ›
Disclosure · New
2026-08-15
~9 min read
A bug bounty report says your obfuscated JavaScript was reversed
Recovering readable form from delivered JavaScript is not itself a vulnerability, and your policy should say so first. How to triage what the researcher actually found, and which findings deserve payment.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Your machine learning model is not obfuscated
Browser-side inference ships four things and only one of them is JavaScript you wrote. Why the weights file is never a candidate for the protection step, and which part of the pipeline is the real asset.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Will runtime defense block AI browser agents?
Agent extensions patch exactly the platform functions the integrity guard watches. What the default watch list contains, why pre-existing patching does not clear, and which failure action to choose.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Obfuscating htmx and Alpine apps: your logic is in the markup
An HTML attribute is not JavaScript, so the protector preserves it exactly and protects nothing in it. The renaming options that silently break an Alpine expression, and the exclusion list that prevents it.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Obfuscating ad tech JavaScript fights the channel that delivers it
A creative never runs on your hostname, so the domain lock fails before it reads the allowlist. Why the runtime guards misfire in a multi-party page, and what is genuinely worth protecting on the publisher side.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break islands and streaming SSR?
Some script on the page came from your build and some was written by the server moments before it arrived. What that means for hydration payloads, and the one failure mode that breaks these architectures.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Protecting WebUSB and Web Serial device code
The permission prompt is the security boundary, and obfuscation changes no authority at all. What is worth protecting in a hardware-facing web app, and why the real control belongs in the firmware.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Your bot detection code runs on the bot
Anti-automation script is delivered to the machine it is meant to evaluate. Why the common bypass never reads your code, what per-build polymorphic output genuinely buys, and why a fixed seed is the wrong choice here.
Read article ›
Boundaries · New
2026-08-14
~9 min read
Your WebGL shaders are not obfuscated
A shader is not JavaScript. It is a string handed to another compiler and it must arrive intact, so it is recoverable at the API boundary in one step. Why excluding shader source from the string transforms is usually right.
Read article ›
Compatibility · New
2026-08-14
~9 min read
Does obfuscation change your browser support matrix?
A protector is a source-to-source transform, not a transpiler, so it emits the language level it read. Why there is no ECMAScript target option, what syntax the injected guards use, and the build order that keeps a wide matrix intact.
Read article ›
Runtime defense · New
2026-08-14
~9 min read
Your JavaScript expiry date runs on their clock
A date lock reads the local calendar on the user's own machine, with no network involved. What that makes it good for, what it cannot hold against, and how to pair it with a server-side deadline.
Read article ›
Compatibility · New
2026-08-14
~9 min read
Does obfuscation break internationalization?
Translated text is data and obfuscation transforms code, so in the usual setup nothing happens. The exceptions that matter: bundled catalogues, message lookup through renamed members, and extraction tooling run in the wrong order.
Read article ›
Build integration · New
2026-08-14
~9 min read
Obfuscating over-the-air JavaScript updates
A hot-pushed bundle is the same artifact the packager would have embedded. What is different is release management: why delta updates balloon under per-build renaming, and why signing the payload matters more than obscuring it.
Read article ›
Honest limits · New
2026-08-14
~9 min read
Obfuscation will not fix a client-side vulnerability
Renaming changes how a program reads; a vulnerability is what it does with untrusted input. Why XSS, prototype pollution and request forgery are unaffected, and how protection can quietly silence your own scanners.
Read article ›
Runtime defense · New
2026-08-14
~8 min read
Can you geo-restrict JavaScript in the browser?
No, and the reason is worth more than the feature: time zone and locale are settings, geolocation needs permission, and the IP address is only visible to your server. What the locks that do exist actually assert.
Read article ›
Architecture · New
2026-08-14
~8 min read
Your AI system prompt is in your bundle
The prompt, the tool definitions, the model routing and the guardrail list all ship to the browser. Why encrypting strings is friction rather than confidentiality, and what belongs server-side instead.
Read article ›
Browser Security · New
2026-08-14
~8 min read
Does obfuscation break Trusted Types?
Trusted Types closes DOM injection sinks, and protected output passes through enforcement cleanly with one narrow exception. Which two options emit an eval, and why the injected runtime modules are sink-free.
Read article ›
Third-Party Risk · New
2026-08-14
~9 min read
Obfuscation, tag managers and the scripts you do not control
The APIs analytics vendors wrap are almost exactly the APIs the anti-tamper guard watches, so your own marketing tags trip it. The default watch list in full, and what the script inventory detects.
Read article ›
API Security · New
2026-08-14
~9 min read
Obfuscation will not hide your GraphQL API
The query documents your client sends are protocol, not code style, so they travel in plain text however the bundle looks. What protection genuinely covers, which server-side controls do the work, and the member-renaming rule that keeps response handling intact.
Read article ›
Build Strategy · New
2026-08-14
~9 min read
Obfuscating a multi-tenant SaaS frontend: one build or one per tenant?
Per-tenant builds cost shared caching, a multiplied release matrix and per-build report retention, and buy distinguishability rather than protection. The three cases where they are genuinely right, and where tenant isolation actually lives.
Read article ›
Supply Chain · New
2026-08-14
~9 min read
Does obfuscation break your SBOM?
A lockfile-derived bill of materials is untouched by protection. An artifact scanner is broken completely by it — and so is any vulnerability scan pointed at the shipped bundle. How to tell which kind you have, and where each step belongs.
Read article ›
Media · New
2026-08-14
~10 min read
Can obfuscating your player stop video piracy?
Under Encrypted Media Extensions the key never reaches page script, so there is nothing in the player to hide. What streaming client code is genuinely worth protecting, and which controls actually move the number.
Read article ›
Workflow · New
2026-08-14
~9 min read
Should you obfuscate during development?
No — and the Vite and Next.js integrations already default to skipping it. But a protected build nobody has run until release day is the other failure mode. The four-tier arrangement that fixes both.
Read article ›
Delivery · New
2026-08-14
~10 min read
When your CDN rewrites your protected JavaScript
Protection is meant to be the last transformation — but CDN minifiers, script loaders and hosting plugins quietly add another one after the build. What breaks first, and the ten-minute digest check that names the culprit.
Read article ›
Realtime · New
2026-08-14
~9 min read
Your WebSocket protocol is in your bundle
Realtime clients ship the protocol and the frames are readable in DevTools regardless of the build step. Why every message needs server-side authorization, what protection genuinely covers, and why WebSocket sits on the anti-tamper watch list.
Read article ›
Node.js · New
2026-08-14
~8 min read
Compiling Node.js to a binary is not obfuscation
Single-executable builds embed your JavaScript as text and bytecode keeps the whole constant pool, so string literals and property names survive. What each tool removes, and the order to run packaging and protection.
Read article ›
Client-side data · New
2026-08-14
~8 min read
Obfuscation does not protect what you store in the browser
Protecting the code changes nothing about the values it writes. Why localStorage, IndexedDB and the Cache API stay readable, why encrypting in client code moves the problem, and what belongs in browser storage.
Read article ›
Web security · New
2026-08-14
~8 min read
Can someone put your protected app in an iframe?
Domain locking does not stop framing, because inside a frame your document still reports your own hostname. What frame-ancestors actually does, and the delivery contexts where an empty hostname fires the guard.
Read article ›
Authentication · New
2026-08-14
~8 min read
Obfuscation, passkeys and WebAuthn
A passkey private key never enters your JavaScript, so obfuscating the ceremony protects no credential. What is actually worth protecting in an authentication bundle, and why password managers trip the tamper guard.
Read article ›
Security & Risk · New
2026-08-14
~8 min read
Obfuscation does not stop an insider — and what actually does
A contractor with a repository clone holds the input to your build, not the output — comments, history and all. Where the boundary actually sits, the one thing in the toolchain that helps after a leak, and the controls that do the real work.
Read article ›
Legal & Compliance · New
2026-08-14
~8 min read
Obfuscation and trade secrets: does it help your legal case?
Trade-secret protection asks what reasonable measures you took — and a bundle sent to every visitor is a steep hill. Which logic to move server-side, what a protection run contributes as dated evidence, and where the argument stops.
Read article ›
Supply Chain · New
2026-08-14
~7 min read
Obfuscation will not stop a malicious dependency
Obfuscation defends the outbound direction. A poisoned package travels inbound and is in your bundle before protection runs — where the transforms hide it from your reviewers as well as from everyone else. The pipeline order that fixes it.
Read article ›
Architecture · New
2026-08-14
~8 min read
Obfuscating micro frontends and module federation
A host and a remote are separate builds, so they never share a generated mapping. What is actually on the cross-build contract, why member renaming is the sharp edge, and the report-per-remote trap that surfaces after the first production incident.
Read article ›
Runtime Integrity · New
2026-08-14
~8 min read
Can you stop browser extensions modifying your site?
No — an extension runs earlier and with more privilege than your page. But per-build polymorphic output breaks a targeted userscript on every release, which is better attrition than any detection feature. Why the right response is to degrade, not block.
Read article ›
Compatibility · New
2026-08-14
~8 min read
Does obfuscation break accessibility?
The transforms cannot touch the accessibility tree — ARIA, roles and label strings all survive. The risk is two runtime-defense options: one suppresses the context menu for everyone, the other mistakes an accessibility overlay for an attacker.
Read article ›
Product & Risk · New
2026-08-14
~8 min read
Your JavaScript bundle is leaking your roadmap
Feature flags ship the code weeks before the announcement, and a thirty-second search of your production bundle returns flag names, unreleased endpoints and UI copy — in your own vocabulary. What raises the cost, and what only server-side evaluation removes.
Read article ›
Architecture · New
2026-08-14
~8 min read
Should you compile to WebAssembly instead of obfuscating JavaScript?
It does make an algorithm harder to read. It also leaves your strings in a readable data section, your exports named, and your JavaScript glue in plain sight — so the license check you moved there is no harder to bypass.
Read article ›
Commercial · New
2026-08-14
~8 min read
Source code escrow and due diligence when your JavaScript is obfuscated
Escrow holds source; obfuscation is a build step, so they only conflict when someone deposits the wrong artifact. Plus the seeded rebuild that lets a verification agent prove the deposit really produces the shipped files.
Read article ›
Build & Delivery · New
2026-08-14
~8 min read
Testing obfuscated JavaScript: where protection belongs in your pipeline
Unit tests belong before protection and end-to-end tests belong after it — and a green pipeline that never executed the shipped bytes is the failure nobody notices. The assertions that break, and why snapshots need a seed.
Read article ›
Security Review · New
2026-08-14
~8 min read
Your security scan flagged obfuscated JavaScript. Now what?
Three findings wear the same words: an informational note, “we could not assess this”, and a genuine CWE-656 design problem. Read which one you got before writing a word — then close it with evidence.
Read article ›
Threat Model · New
2026-08-14
~8 min read
Can you disable DevTools and View Source?
No, and the reason tells you which alternatives are worth switching on. What debug protection, key blocking and self-defending output actually do, what they cost in support tickets, and the three things that genuinely work.
Read article ›
Threat Model · New
2026-08-14
~8 min read
Does obfuscation stop web scrapers?
A scraper reads your responses, not your source, and a headless browser runs protected code exactly as a real one does. There is one case where obfuscation is decisive — a request signature computed on the client — and it is the case worth spending on.
Read article ›
Deployment · New
2026-08-14
~8 min read
Obfuscation and long-term caching
Polymorphic output means unchanged source ships changed bytes, so every content hash moves and every returning visitor downloads everything again. Why pinning a seed forever is the wrong fix, and the per-release pattern that keeps both properties.
Read article ›
Engineering · New
2026-08-14
~8 min read
Obfuscating JavaScript in a monorepo
Protect the deployable, not the package. Why protecting an internal library double-processes your code, why there is no shared identifier map across runs, and how polymorphic output turns a task-runner cache into a permanent miss.
Read article ›
Engineering · New
2026-08-10
~7 min read
Does obfuscation break code splitting and dynamic imports?
Three concrete mistakes cause almost every broken lazy chunk: protecting chunks in separate passes, renaming files the bundler runtime looks up, and transforming strings the loader still reads. Each has a direct fix.
Read article ›
Deployment · New
2026-08-10
~7 min read
Obfuscation and Subresource Integrity
SRI verifies bytes and protection changes bytes, so ordering decides whether your script runs at all. Hash last, know why polymorphic output churns every hash, and use a seed when something downstream needs a stable one.
Read article ›
Correctness · New
2026-08-10
~8 min read
Obfuscating web components: the names the browser calls
The platform invokes connectedCallback by name and reads your options-object keys by name, and neither shows up as a caller in your source. Which names are contracts, and what is still safely protectable.
Read article ›
Engineering · New
2026-08-03
~7 min read
Does obfuscation break Web Workers and Service Workers?
A worker is a second entry point with its own global scope and no DOM. Here is what that changes about which transforms are safe, why postMessage keys are a contract, and how to test it in ten minutes.
Read article ›
Engineering · New
2026-08-03
~7 min read
Minify before or after obfuscation?
Bundle, minify, then protect — protection runs last. The two wrong orders fail differently, and one of them silently costs you tree shaking while looking perfectly fine.
Read article ›
Threat model · New
2026-08-03
~8 min read
Can browser DevTools deobfuscate your JavaScript?
Pretty-print is a formatter and reverses nothing that matters. The debugger is the real capability. An honest account of what an analyst gets from each, and the one mistake that undoes everything.
Read article ›
Distribution · New
2026-08-03
~8 min read
Should you obfuscate an npm package you publish?
Usually not — a published package is an input to someone else’s build, so you break their tree shaking and your own support workflow. The four cases where it is still right.
Read article ›
Performance · New
2026-08-02
~8 min read
How much bigger does obfuscation make your bundle?
We measured 42 real libraries. Raw output roughly doubles, while the compressed bytes users download grow much less. See the full results, the outliers, and why already-minified input behaves differently.
Read article ›
Engineering · New
2026-08-02
~7 min read
The newline rules that break JavaScript obfuscators
Five restricted productions make a line break change program meaning. These cases can produce valid output with silently wrong values, so they belong in every rewriting tool’s compatibility suite.
Read article ›
Correctness · New
2026-08-02
~7 min read
Does obfuscation preserve “use strict”?
String tables and wrappers can quietly demote a directive prologue. Here is what changes when strict mode is lost and a small runtime probe that verifies the protected result.
Read article ›
Engineering · New
2026-08-02
~6 min read
Obfuscating ES modules: what changes without a bundler
Export names are a public contract, not safe rename targets. Learn what remains protectable behind that module boundary and how to verify that protected .mjs files still link.
Read article ›
Fundamentals · New
2026-07-27
~8 min read
JavaScript obfuscation techniques explained
Obfuscation is not one thing — it is a stack of transforms with different costs. Identifier renaming, string arrays, encoding and encryption, cross-file member renaming, control-flow flattening, and bytecode virtualization: what each removes, what it costs at runtime, and where to apply it.
Read article ›
Troubleshooting · New
2026-07-27
~7 min read
Obfuscated JavaScript not working? The six causes, in order
It ran before protection and breaks after it. Nearly always one of six things — and the first one, a name matched as a string at runtime, accounts for most of them. How to find which, bisect the transforms, and build a repro worth sending.
Read article ›
Operations · New
2026-07-27
~6 min read
How to debug obfuscated JavaScript in production
Don’t ship the source map. Keep each build’s identifier map private, translate field stack traces locally with jso-symbolicate, and run captured Sentry or Datadog events through the matching adapter — no upload, no key in the browser.
Read article ›
Source handling · New
2026-07-27
~6 min read
Is it safe to use an online JavaScript obfuscator?
A textarea is not a sandbox — pasting is uploading. The ten-second Network-tab test that settles it for any vendor, the questions a security reviewer will ask you, and when to move to CI or a local workflow instead.
Read article ›
Design guidance · New
2026-07-27
~7 min read
How to protect a JavaScript licence or trial check
One boolean stands between your paid product and a free one. Move authority to the server, virtualize the validation path, stop concentrating the decision in a single flag, and instrument tampering so a bypass surfaces in a week rather than never.
Read article ›
Legal & Licensing · New
2026-07-21
~5 min read
Is JavaScript obfuscation legal?
Yes — obfuscating code you own or are licensed to modify is legal and routine. The real constraints aren’t obfuscation itself: honor third-party and copyleft (GPL) license terms, respect publishing rules (browser-extension stores forbid it), and remember obfuscation never launders illegal behavior.
Read article ›
Fundamentals · New
2026-07-21
~5 min read
Obfuscation vs encryption: what’s the difference?
Not the same thing. Encryption needs a key to run and is reversible with it; obfuscation runs directly and only raises the cost of understanding. Anything that “encrypts” client-side JavaScript must ship the key to the browser — so it’s really obfuscation with extra steps.
Read article ›
Deployment hygiene · New
2026-07-21
~6 min read
Why does obfuscated JavaScript trigger antivirus false positives?
Because malware pioneered the same techniques — string arrays, eval loaders, packed blobs — so heuristics fire on the shape, not the intent. How to ship protected code that doesn’t get quarantined: avoid eval, serve external files, sign your builds, keep behavior transparent.
Read article ›
SEO · New
2026-07-19
~5 min read
Does obfuscating JavaScript hurt your SEO?
No — Google indexes the rendered page, not your source, so behavior-preserving obfuscation is SEO-neutral. The real rules: keep JSON-LD structured data readable (it’s data, not code), don’t bloat the bundle (Core Web Vitals), don’t block your JS from crawlers, and verify the rendered DOM is unchanged.
Read article ›
Security engineering · New
2026-07-19
~5 min read
Does obfuscation break Content Security Policy?
Old eval-based packers break strict CSP; modern obfuscation doesn’t. String decoding, control-flow flattening, and VM bytecode are ordinary code — no eval, no new Function — so protected output runs under a strict CSP without unsafe-eval. Serve it as an external file and keep your policy strict.
Read article ›
Engineering · New
2026-07-27
~7 min read
How to verify an obfuscator didn’t silently break your JavaScript
Output that parses is not output that works. Arrow functions lose their this, a unary minus fuses into a decrement, a tagged template stops calling its tag — all valid syntax, all wrong answers. A four-rung verification ladder, what each rung can and cannot see, and why diffing against the original beats testing against expectations you wrote yourself.
Read article ›
Performance · New
2026-07-19
~5 min read
Does JavaScript obfuscation slow down your app?
A little, and it’s controllable. Identifier renaming is essentially free; VM bytecode is meaningfully slower by design. The whole game is matching transform strength to hot vs cold paths — protect the once-per-session license check hard, keep the per-frame loop light, and the cost disappears where it matters.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
Is JavaScript obfuscation reversible?
Yes, in principle — obfuscation isn’t encryption, and code that runs can be understood. But that’s the wrong question. What it actually does is raise the cost of reversing; the goal is to price the attacker you have out of reach. The reversal-cost spectrum, where AI/deobfuscators fit, and why measurable resistance beats an “irreversible” claim.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
You can’t hide an API key in JavaScript
A secret shipped to the browser is already public — the browser has to read it, so anyone can. Obfuscation raises the cost of finding a client-side key but can’t make it secret. What actually works (keep it server-side), the NEXT_PUBLIC_ trap, and where obfuscation genuinely helps: your logic, not your secrets.
Read article ›
Deployment hygiene · New
2026-07-19
~5 min read
Your source maps are publishing your source code
A .js.map maps your shipped bundle back to original names — and with inlineSources, the original source text. Ship one beside a protected bundle and you have published exactly what you protected. How to check what you serve right now, why it keeps happening by default, and the one-line deploy fix.
Read article ›
Supply-chain integrity · Shipped
2026-05-28
~7 min read
Watermarks + signed attestations for protected JavaScript
HMAC-SHA256 watermarks that survive every obfuscation transform, Ed25519-signed release attestations with two-stage verify, pre-flight quota gates, bulk forensic scanner. Cross-language verified across Node, Python, and .NET. Wire format is open. Six lines of GitHub Action YAML covers the whole stack.
Read article ›
JSO AI · Phase 1 shipped
Updated 2026-06-06
~5 min read
JSO AI previews and BYO keys are live
Four endpoints, three browser previews, encrypted OpenAI / Claude account keys, Prometheus usage export, JSON Schema, language client snippets, and RSS. Preview mode works without a key; BYO keys turn the same endpoints into live AI for that account.
Read article ›
Maximum Mode · VM Bytecode Beta
Updated 2026-06-06
~8 min read
VM-based protection for selected sensitive functions
Eligible Corporate+ accounts can test bytecode virtualization for small pieces of high-value JavaScript. The design tradeoffs and why it is opt-in per function rather than whole-bundle default.
Read article ›
AI-Aware Research
2026-05-20
~10 min read
CASCADE and the LLM-deobfuscator question
Google’s CASCADE pairs Gemini with a JavaScript IR to deobfuscate at scale. What the paper actually does, where per-build polymorphism alone falls short against prelude-detection, and what’s on the JSO roadmap to answer it.
Read article ›
Resistance Score · Planned
2026-05-20
~8 min read
The Resistance Score: planned evidence for AI-resistance claims
Every obfuscator markets “AI-resistant,” almost none ship a way to check it. The artifact JSO is designing to make the claim reviewable: a named adversarial probe, a source-free report, and recovery categories.
Read article ›
AI-Aware Research
2026-04-25
~9 min read
Can ChatGPT, Claude, or Copilot reverse-engineer obfuscated JavaScript?
A direct technical answer for 2026. What today’s AI assistants can actually deobfuscate, where they break down structurally, and why per-build polymorphic decoders disrupt the pattern-matching approach LLMs rely on.
Read article ›
Vendor Analysis
2026-04-26
~10 min read
JavaScript VM protection compared: Jscrambler, JSDefender, Verimatrix, OSS virtualizers
Vendor-by-vendor analysis of JavaScript bytecode VM protection — what each product actually ships, how the open-source virtualizers compare, and where selective virtualization fits against whole-bundle approaches.
Read article ›
Runtime Boundaries · New
2026-08-15
~10 min read
Should you obfuscate an edge function?
Code that never reaches a browser has a different adversary. Which runtime guards fail closed with no DOM, why the evaluation-based wrappers are skipped for module source, and the one case where the answer is yes.
Read article ›
What Ships With Your Code · New
2026-08-15
~10 min read
Your pricing logic is in your bundle
Discount tiers and eligibility rules computed in the browser fail twice: they disclose how you price, and they let the customer choose the number. What protection helps with and what it cannot touch.
Read article ›
Build Pipeline Hygiene · New
2026-08-15
~9 min read
Keeping open-source license notices in a protected build
Permissive licenses ask you to preserve attribution notices in what you distribute, and comment removal deletes them. Only the run of comments above the first statement survives, which decides the whole strategy.
Read article ›
Where Authority Lives · New
2026-08-15
~9 min read
Your JavaScript cannot authenticate a payment
Strong customer authentication is a claim about who verified the payer, and a browser is not in a position to make it. Why dynamic linking belongs where the amount is authoritative, and where the checkout risk actually sits.
Read article ›