Cryptography · New
2026-08-16
~10 min read
Does obfuscation break key generation and signing options?
Measured: member renaming can strip the cipher and passphrase from a private key export, so the key lands on disk unencrypted with no error, and it can silently downgrade an RSA-PSS signature to PKCS#1 v1.5.
Read article ›
Data Layer · New
2026-08-16
~10 min read
Does obfuscation break embedded database options?
Measured against node:sqlite: renaming readOnly turned a reporting connection writable and a stray UPDATE landed on the ledger, while renaming a relaxed foreign-key switch broke a bulk import that had been working.
Read article ›
Input Validation · New
2026-08-16
~10 min read
Does obfuscation break mass assignment guards?
Measured with class-validator: renaming the whitelist option let an isAdmin flag from the request body reach the entity, and the same rename turned the request that should have been rejected into a silent success.
Read article ›
Observability · New
2026-08-16
~10 min read
Does obfuscation break log redaction?
Measured with util.inspect: renaming the depth and string-length switches put a full session token into a log line that had been 54 characters, and renaming a name your own code owns changed the field name in the log itself.
Read article ›
Authentication · New
2026-08-16
~10 min read
Does obfuscation break token verification rules?
Measured with jose: renaming the issuer, audience, algorithms, required-claims and max-age keys in a verification policy admitted five tokens that had been refused, and renaming the whole policy object admitted every one of them.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break TLS and Certificate Options?
A TLS connection is configured through an options object whose names node fixes. Protection alone is clean on all five profiles. Member renaming silently downgraded a service that pins TLS 1.3 onto TLS 1.2, let an anonymous client hold a session on a server that requires client certificates, and dropped the cipher pin, the ALPN protocol and the SNI name without an error anywhere.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Sandbox and VM Options?
A sandbox is only as strong as the options object that configures it. Protection alone is clean on all five profiles. Member renaming let a runaway plugin run to completion against a 60 millisecond budget, re-enabled code generation from strings inside the sandbox, returned control while the plugin was still pending, and erased the tenant name from the incident frame.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Compression Options?
Compression levels, output caps and window sizes are properties on an options object the zlib bindings read. Protection alone is clean on all five profiles. Member renaming removed the cap that stops a decompression bomb, so a 24 kilobyte upload expanded to 24 megabytes and was accepted, and it turned a deliberately cheap compression path into the expensive default.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Server Timeouts and Limits?
An HTTP server's request timeout, headers timeout, keep-alive and header size cap are properties on one options object. Protection alone is clean on all five profiles. Member renaming served an oversized header block with a 200, let a slow-drip upload run past every deadline, and disabled the request timeout entirely through an option nobody thinks of as a security control.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break DNS and Socket Options?
Address family, resolver budgets and socket timeouts are properties on option objects the dns and net modules read. Protection alone is clean on all five profiles. Member renaming resolved an IPv4-only service to an IPv6 address, changed the shape of a lookup result from an array to a string, and left a socket waiting on a wedged upstream with no timeout at all.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Cookie Attributes?
HttpOnly, Secure, SameSite and Max-Age are read out of an options object by whatever writes your Set-Cookie header. Protection alone is clean on all five profiles. Member renaming dropped the flags from the emitted header, made a session cookie readable by script, turned logout into a no-op, and left the application's own security self-check reporting no findings.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Allowlists and URL Validation?
A validation library reads your policy out of an options object. Protection alone is clean on all five profiles. Member renaming did not make the checks fail; it reverted them to the library's defaults, so an off-host redirect target was accepted, a plain HTTP URL passed an https-only rule, a blocked mail domain was allowed, and a numeric bound stopped applying.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Your Web App Manifest?
A web app manifest generated in JavaScript is a document whose keys the browser fixes. Protection alone is clean on all five profiles. Member renaming published a valid JSON file that no longer describes an installable app: no launch URL, an untitled install prompt, no icons, an empty jump list, and a service worker update policy that reverted to the default.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Password Hashing Parameters?
Node reads cost parameters, key encodings and authentication tag lengths out of ordinary option objects. Protection alone is clean on all five profiles. Member renaming made every stored password stop verifying while the record beside the hash still claimed the strong cost parameter, and made an authenticated cipher accept a truncated tag.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Glob and Ignore Patterns?
Ignore patterns are strings and keep working. The switches that qualify them are properties on an options object. Protection alone is clean on all five profiles. Member renaming walked a capitalised test file into the published artifact while the packager's own leak audit still reported nothing.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Feature Flags and Remote Config?
A flag payload is written by a service you do not build with. Protection alone is clean on all five profiles. Member renaming turned a shipped feature off, turned a disabled feature back on, made a 25 percent rollout reach everybody, and left the operator report saying every flag was off while a disabled feature was running.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Named Capture Groups?
A regular expression survives protection byte for byte, so the group names inside it never move. The reads of those names do. Protection alone is clean on all five profiles; member renaming left the numbered groups and the replacement pattern working perfectly while every named read returned undefined, and turned a valid identifier into a rejected one.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Property Descriptors?
The dictionary you hand Object.defineProperty is read by the JavaScript engine, which makes its keys an external contract. Protection alone is clean on all five profiles. Member renaming produced an object that serialises as empty with every value intact, an accessor that quietly became a value, and a read-only property that accepted a write into a second field.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break OpenAPI and Generated Clients?
An API description your build emits is an object literal whose key names are fixed by a specification and read by tools you do not ship. Protection alone is clean on all five profiles. Member renaming published a document with a generated key at the top level, produced an empty client from a valid-looking file, and named every generated method after a fallback string.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break AST Tools and Codemods?
A parser writes the node objects your tool reads, and your visitor object is read by the traversal library. Protection alone is clean on all five profiles. Member renaming produced a linter that reported a file clean, a codemod that reported zero changes, and a summary marked ok, all without visiting a single node.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Plugin and Extension APIs?
A plugin API is a contract with code you did not build and cannot rebuild. Protection alone is clean on all five profiles. Member renaming makes a valid plugin fail its own load check, throws the error inside the vendor's code rather than yours, and in a two-build experiment made a host print a plugin's setup function where the plugin name belongs.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Background Jobs and Queues?
A job payload is written by one process and executed by another, often from a different release. Protection alone is clean on all five profiles. Member renaming made every job unroutable, removed the retry limit so an exhausted job ran again, and emptied the dead-letter log while jobs were still being parked.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break File System Options?
File system options do not carry data, they carry permission and limits. Protection alone is clean on all five profiles. Member renaming turned an exclusive-create guard into a silent overwrite, turned an append into a truncation, and made a copy exclusion stop excluding -- none of which raised an error.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break GraphQL Resolvers?
A resolver map is an object literal whose keys must equal the field names in your schema, and the schema is text that every shipped client already agrees with. Protection alone is clean on all five profiles. Member renaming made every field resolve to null while the response kept its shape, and made a conformance check report implemented fields as unimplemented.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Package Manifests and Module Resolution?
A build that writes a package manifest is writing a file node reads back with its own resolver. Protection alone is clean on all five profiles. Member renaming made node fail to resolve a generated entry point, dropped the version out of every crash report, and left a build that reads its own manifest reporting no dependencies at all.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Database Rows and ORM Models?
A database driver builds row objects from the column names in your SQL, so the property names on a row are not written by your bundle. Protection alone is clean on all five profiles measured against a real driver. Member renaming makes every column read undefined, turns order totals into NaN, drops columns out of the JSON you send onward, and makes the driver reject a named parameter it has never heard of.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break HTTP Request Handlers?
Request headers, query parameters and JSON bodies are written by the caller and by the runtime, not by your bundle. Protection alone is clean on all five profiles measured against a real server. Member renaming makes query values read undefined, drops fields out of the reply, throws at the first header access, and -- in the sharpest arm -- sends a request to a different host entirely.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Server-Sent Events and Log Streams?
Every record in a log feed or an event stream is written by the sender. Protection alone is clean on all five profiles measured. Member renaming turns an error stream into an empty one, collapses grouped totals into a single bucket named undefined, silences the alert that exists to page someone, and makes an event parser discard every frame before failing.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Health Checks and Metrics?
Memory figures, CPU times and resource usage come out of objects the runtime builds, so their property names belong to the platform. Protection alone is clean on all five profiles measured. Member renaming makes a health endpoint report degraded, a memory threshold alert that can never fire, and a container read that throws before the process finishes starting.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Multi-File Builds?
Protecting two files in separate runs does not just make them fail to find each other's property names. Measured here: each run restarts its own counter, so the same generated name means a different property in each file, and every value arrives intact and attached to the wrong name. Protecting the same code in one run was correct in every read.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Form Fields and FormData?
A form's field names are written by the browser from your HTML, and read by your server. Nothing in the bundle authors them. Protection alone is clean on all five profiles measured. Member renaming makes every field read as undefined, puts a generated identifier into the request body and into the message the user is shown, and turns a ticked checkbox into an unticked one.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break CSV and Spreadsheet Imports?
A CSV header row is written by whoever exported the file, and parsing it into row objects renames nothing. Protection alone is clean on all five profiles measured. Under member renaming the column reads return undefined, totals become NaN, and the record written back out does not contain a wrong value for the column -- it does not contain the column at all.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Schema Validation?
A validation schema is a literal in your source; the payload it validates comes from a caller. Protection alone is clean on all five profiles measured. Under member renaming the two sides stop agreeing, and the failure is not a crash: valid requests are rejected for a field the caller never sent, the caller's real field is reported as unknown, and type errors stop being reported at all.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Webhooks and Signature Verification?
A webhook body is written and signed by a sender you cannot redeploy. Protection alone is clean on all five profiles measured, signature check included. Under member renaming the signature still verifies and the handler goes wrong afterwards: events route to the ignore branch, and a second, entirely different event is silently discarded as a duplicate of the first.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Analytics Events?
Analytics property names are the one contract where your bundle writes the keys and something you never deploy reads them. Protection alone is clean on all five profiles measured. Under member renaming every read inside the application stays correct and only the JSON leaving the process changes, so nothing breaks except the dashboards, funnels and alerts built on those names.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Error Codes and errno?
Every error-handling branch in a Node program tests a property the runtime wrote, not one your build did. Protection alone leaves that intact on all five profiles measured. Member renaming turns err.code into undefined, and because no comparison against undefined ever matches, every dispatch quietly falls through to its else branch: missing files become unexpected failures, and a transient error stops being retried.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break JSON Config Files?
The keys in a config file are written by whoever edits that file, and parsing it does not rename anything. Protection alone is clean on all five profiles. Member renaming produces the quietest failure this site has measured: a config file that is present, valid, and completely ignored, while the validator that is supposed to catch exactly that reports no problems at all.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Command-Line Flags?
A CLI's option keys are built at runtime out of the text the user typed, so they are a contract with a person rather than with your code. Protection alone is clean on all five profiles. Member renaming makes every flag revert to its default without a word of complaint -- including, in the measured run, the safety flag that was the only thing standing between the tool and overwriting a file.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Saved State and Migrations?
Stored state is the one contract whose other party is your own past build, and it cannot be redeployed. Protection alone is clean on all five profiles. Under member renaming, the measured worst case is not lost data: it is a release that reads yesterday's record one slot out of step, so every value is present, intact, and attached to the wrong name.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Environment Variables and Build Config?
Protection on its own leaves configuration alone: every arm of an environment-driven config module measured identically across five profiles. Member renaming is where it gets interesting, because an environment variable name is a contract with whatever sets it, and the one build that reads a renamed name does not fail loudly. It silently identifies itself as the wrong release channel.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break JWT and Token Claims?
A token is authored by a server and arrives as base64 JSON, so its claim names are a contract your build does not own. Protection alone leaves them alone. Member renaming produces one loud failure, one silently truncated payload, and an expiry check that stops rejecting expired tokens.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Child Process and Worker Options?
Node reads spawn and worker option dictionaries inside the runtime, so those key names are a contract your build does not own. Protection alone is clean on every profile. Member renaming produces a child that inherits the whole parent environment, a working directory that is silently wrong, an output cap that stops capping, and a string that quietly becomes a Buffer.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break String Property Paths?
A path written as a string -- a lodash get, a mustache placeholder, a grid column key, a JSON Pointer -- is data, and data is not renamed. The properties it names are. Under member renaming that gap produces a lookup that returns its fallback, a template that shows the placeholder to the user, and a write that lands in the wrong place while the read-back looks merely stale.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Destructuring and Default Values?
Destructuring survives obfuscation intact in the default configuration, across parameters, nested patterns, array patterns, rest elements and catch clauses. Turn member renaming on and a pattern key becomes a property read like any other, with one specific shape that desynchronises silently and substitutes its default.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Async Iteration?
The article on async and await explicitly declined to cover for await and async generators, and the article on iterators and generators found a real defect in the synchronous protocol. This one measures the asynchronous half: ordering, interleaving, early exit, cleanup, delegation and rejection all survive on every profile, including the target where synchronous for-of does not.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Your State Management Store?
Action types, payloads, reducers and selectors all survive member renaming, because both halves of every one of those contracts live in your own code. The state that leaves your process does not, and one very ordinary field name collides with a built-in array method.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break i18n Message Catalogs?
Two catalogs with identical content, one written as a JavaScript object and one loaded as data. Under member renaming the first shows users raw message keys and the second is untouched. The interpolation parameters break both, which is why the obvious mitigation is only half a fix.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Iterators and Generators?
Four other articles on this site defer to this one, and they are right to. On the default output target a for-of loop over a generator is rewritten into a loop over an array, which drains the generator completely before your loop body runs even once. The values are correct and almost everything else about the loop is not.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Iterator Helpers?
A lazy chain of map, filter, take and toArray over an infinite generator came through five protection configurations byte-identical, laziness included. What breaks is member renaming, and the boundary is sharp: helper chains over built-in sources survive renaming the iteration protocol, while the same chain over an iterable you wrote does not.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Set Operations?
Union, intersection, difference and the subset predicates came through five protection configurations unchanged. The measured failure is a set-like object of your own: the platform reads size, has and keys off it by name, and renaming one of them produced an error message that names a property sitting in plain sight in your source.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Memoization and Caches?
Memoization, string cache keys and an LRU with its own bookkeeping all came through five protection configurations unchanged. Then one renamed property stopped the eviction step without stopping the counter that reports it, so the cache grew past its limit while its own metrics said it had evicted.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break fetch and Request Options?
A POST with headers, a body and a redirect policy came through five protection configurations byte-identical. What breaks is member renaming reaching the init dictionary, and the sharpest measured case is a POST that the platform rejects as a GET while your source still plainly reads POST.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Abort Signals and Cancellation?
AbortController, its signal, its reason and a timeout signal all survived five protection configurations unchanged. Member renaming produces the worst possible failure for a cancellation primitive: a guard that always reports the work was not cancelled, with nothing thrown and nothing logged.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break addEventListener Options?
Event registration, dispatch and custom event payloads survived five protection configurations unchanged. Member renaming reaching the options dictionary produced the measured result that a once-only listener fired on every dispatch and an aborted listener kept running, with nothing thrown.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break TextEncoder and TextDecoder?
Encoding and decoding, including accented text, an em dash and a byte order mark, came through five protection configurations unchanged. Member renaming reaching the decoder options turned a validating decoder into a permissive one and corrupted a character split across two streamed chunks.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Intl and Locale Formatting?
Currency, date, plural and collation formatting came through five protection configurations byte-identical. The break is member renaming reaching the options object, and it does not throw: a currency amount quietly formats as a plain decimal and a date lands on the wrong calendar day.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break the User Timing API?
Marks, measures and their durations survived five protection configurations unchanged, because a mark name is a string and strings are not rename sites. What breaks is reading the entry objects the platform hands back, and the failure looks like a performance dashboard full of blanks.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break WeakRef and FinalizationRegistry?
A WeakRef dereferenced to the identical object and a FinalizationRegistry accepted its registrations and unregister token across five protection configurations. The surface is unusually small: only the platform method names can be broken, and the held value is yours to name.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Retry and Backoff Configuration?
A retry helper with an exponential backoff schedule and a circuit breaker survived every protection configuration, including member renaming of its own options object. It stops surviving the moment that object is loaded from JSON, and the failure is a silent revert to defaults with a NaN delay.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break WebAssembly Interop?
A WebAssembly module compiled, instantiated, called its imported callback and returned the same value in all five configurations. The break is member renaming reaching the import object, whose keys are strings compiled into a binary the JavaScript obfuscator never opens.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Error Cause Chains?
Error cause chains, AggregateError and the walk a crash reporter does over them measured identical in all five configurations. Member renaming breaks them two ways, and the quieter one leaves your reporter shipping the word undefined instead of a message.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break toSorted, with and the New Array Methods?
The non-mutating array methods and Object.groupBy measured identical in all five configurations, including non-mutation and comparator stability. The measured curiosity is that arr.with survives member renaming while arr.at does not, and the reason is that with is a reserved word.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Tagged Templates?
Tagged templates keep the per-call-site caching and the frozen strings array that css-in-js, lit-html and graphql-tag memoise on, measured across five configurations. The breaks are member renaming reaching strings.raw or length, and both are loud.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break UMD and module wrappers?
A UMD wrapper picked the same branch before and after protection in all five configurations, including the AMD and global-fallback paths. Letting member renaming match exports turns module.exports into a generated name and ships a package that exports nothing without throwing.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break duck typing and capability checks?
Code that decides what an object is by asking which members it has measured identical in five configurations. Member renaming breaks it two measured ways: a real promise stops being recognised as thenable, and a validator driven by a list of required names reports every field missing.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break streams and backpressure?
Reader loops, transform streams and cancellation measured identical against node's real WHATWG streams. Member renaming reaching the underlying-source callbacks produces the quietest failure on this site: no chunks, no output, no error and a successful exit.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break undefined and optional reads?
Absent, undefined and null stayed distinguishable in all five configurations, along with void 0, an array hole and a local that shadows undefined. The one measured break is an optional read addressed by a string key while member renaming rewrites the declaration.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Function.name and reflection?
Identifier renaming changes fn.name, constructor.name and the parameter names readable through Function.prototype.toString, while arity and the native-code marker survive. Name-keyed registries and implicit dependency injection are the two patterns that break.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Web Crypto?
Digests, HMAC signing and an AES-GCM round trip measured byte-identical against a real WebCrypto implementation in five configurations. The one way to break it is pointing member renaming at the algorithm dictionary or the SubtleCrypto method names.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break data-* attributes and dataset?
Attribute reads, the dataset camelCase bridge, selector strings and class lists all measured identical. Member renaming reaching a dataset key detaches your JavaScript from your HTML silently, producing undefined, NaN and false rather than an error.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break eval and new Function?
The Function constructor, indirect eval and string-built helpers behave identically, and their source text passes through unprotected. Direct eval that reads a renamed local stops resolving, which is the one measured break.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break date and time handling?
ISO round trips, epoch arithmetic, UTC field access, month and day normalisation, leap years and fixed-locale formatting all measured identical. The surprises in this area belong to the Date API, and protection preserves them faithfully.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Promise.all and Promise.race?
All four combinators, thenable adoption, AbortController and microtask ordering measured identical. The real hazard is member renaming reaching then, status, value or reason, which we measured breaking hard.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break try, catch and finally?
The finally return-override rule, rethrow identity, nested handler ordering, per-iteration finally with break and continue, and optional catch binding all measured identical on both targets.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break client-side routing?
Pattern compilation, parameter extraction, query parsing, history navigation and guards measured identical. Route strings are data, which is also why protection does not hide your route table.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation change evaluation order?
Argument order, postfix and prefix increment, compound assignment, the comma operator, short-circuiting and getter side effects all measured byte-identical. The sample was built to expose reordering and found none.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break your event emitter?
An emitter with on, off, once and emit measured identical, including with its own API renamed. Event names are strings and survive; the boundary to watch is a bus shared across separately protected bundles.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break URL and query string building?
URL, URLSearchParams, encodeURIComponent and relative resolution measured identical, including under the string table. What protection does not do is hide the endpoints your bundle calls.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break emoji and code points?
String length in code units, surrogate pairs, normalization, code-point iteration and the regexp u flag all measured identical. The bugs in this area are in the original code and are preserved faithfully.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break number formatting?
toFixed, toPrecision, toString with a radix, parseInt and parseFloat all measured byte-identical after protection, including the rounding cases that look like bugs. The only way to break them is a member pattern matching a built-in name.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break modern string methods?
replaceAll, padStart, trimStart, at and split with a limit measured identical, including under the string table that moves and encodes every literal. String identity and immutability hold too.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break type coercion?
Coercion, loose equality, truthiness and wrapper objects all measured unchanged. But renaming a member called valueOf or toString silently disables the protocol and yields [object Object] with nothing thrown.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break math and floating point?
Math methods, floating point results, 32-bit bitwise operators and a hand-written FNV-1a hash all measured byte-identical, and unparenthesised mixed-precedence expressions kept their values.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break frozen and sealed objects?
Object.freeze, Object.seal and property attributes measured identical after protection. The one shape that quietly changes is a property defined by string with defineProperty and then read by dot access under member renaming.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break closures and scope?
Closures, the module pattern, shadowing and loop capture all came through identical, including the per-iteration binding let gives in a loop on the ES5 target. Renaming is scope-aware, which is why.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break the arguments object and rest parameters?
The arguments object, rest parameters and spread at call sites measured identical, because almost nothing in variadic code is a name. One number does move: Function.length on the ES5 target.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break recursion?
Direct and mutual recursion, named function expressions and memoised recursive closures all measured identical, and stack depth headroom was measured rather than assumed.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break typed arrays and binary data?
Typed arrays, ArrayBuffer views and DataView endianness measured identical after protection, because binary code is built from index access and numeric arguments rather than from names.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break Map and Set?
Map, Set, WeakMap and structuredClone come through unchanged, including object identity as a key and insertion order, because a collection key is a value at run time rather than a name in the source.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break JSON serialization?
JSON.stringify and JSON.parse behave identically after protection, hooks included. The two ways member renaming does change your payloads are specific, silent and measured here.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break prototype chains?
Delegation, shadowing and instanceof all survive renaming because both ends of a lookup are rewritten together. Where a rename shows up is reflection by string, which names a property the transform never rewrote.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break JavaScript symbols?
Symbol-keyed properties and the well-known symbol protocols come through protection unchanged, because a symbol key is always a computed access and computed access is not one of the three places member renaming rewrites a name.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break this binding?
Renaming identifiers cannot move a receiver, because this is fixed by the shape of the call site rather than by any name. Methods, arrows, call, apply and bind all measured identical after protection.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break switch statements and string comparison?
The string table replaces literals with calls that return the same primitive strings, so strict equality, switch matching and fallthrough keep working. Measured with MoveStrings and EncodeStrings enabled.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation break sparse arrays and sort order?
Array holes stay holes, sort stays stable, and length keeps truncating, because array shape is runtime state that the transforms have no syntax to reach.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break getters and setters?
Accessor properties come through protection intact: the getter still computes, the setter still runs its side effect, and the property descriptor still reports enumerable. The one thing that moves is the accessor name.
Read article ›
What survives · New
2026-08-15
~10 min read
Does obfuscation change object key order?
Key enumeration order is a specified property of JavaScript objects, and protection preserves it exactly: integer-like keys first, then string keys in insertion order, with Object.keys, for...in and JSON.stringify all agreeing.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break modern JavaScript operators?
Logical assignment, exponentiation, numeric separators and optional catch binding all come through with identical behaviour on both target versions, including the ES5 path that rewrites several of them into older syntax.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break async and await?
Async functions keep their exact ordering through protection: synchronous code still runs first, microtasks still run in the right place, and a rejected promise is still caught by the try/catch around it.
Read article ›
What survives · New
2026-08-15
~10 min read
Your regular expressions are not obfuscated
A regular expression literal comes out of protection byte for byte identical to the way you wrote it. Named capture groups, lookbehind and Unicode property escapes are all still there in the shipped bundle.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break BigInt and large integer IDs?
BigInt literals, hex BigInt literals and values built with BigInt() all survive protection unchanged. The real hazard with large identifiers was already in your source before you protected anything.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break labeled statements?
Labels and their break and continue targets survive protection in both output targets, including through the rewrite that changes the shape of the loop they label.
Read article ›
What survives · New
2026-08-15
~10 min read
What JavaScript obfuscation does not rename
An inventory of the things that come out of protection with their original text intact: regex literals, import specifiers, bracket-access keys, label names, private member names and exported names.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break Proxy, Reflect and defineProperty?
Member renaming rewrites dotted access and object-literal keys. It never rewrites a property name you hand to an API as a string, and that one asymmetry explains every metaprogramming failure people report.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break cross-tab messaging?
BroadcastChannel, SharedWorker and Web Locks coordinate several tabs of the same app. Two of the three carry property names between contexts, and the tabs are not always running the same build.
Read article ›
Diagnostics · New
2026-08-15
~10 min read
Profiling and memory leaks in obfuscated JavaScript
Symbolication restores a stack trace. It does not restore a heap snapshot or a CPU profile, because those read names out of live objects rather than out of an error, and no mapping file is consulted.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break class private fields?
A private name is not a property name, and the engine has to treat it as its own kind of thing. Why hash-prefixed members are skipped by the member transform, why they stop a class being downlevelled, and the one class-field case that used to fail silently.
Read article ›
Browser Platform · New
2026-08-15
~10 min read
Obfuscation and Permissions-Policy
Permissions-Policy is a header, so nothing in your bundle can edit it and an attacker holding your code cannot grant themselves a capability. It is also a common cause of failures that get blamed on the obfuscator.
Read article ›
Third-Party Scripts · New
2026-08-15
~10 min read
Obfuscation and cross-site cookie access
If your script runs on other people's pages, its cookie access is a functional dependency that browsers are steadily restricting. Obfuscation neither helps nor hinders the migration, but it does change how you debug it.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break audio and paint worklets?
A worklet does not run in the window, and the runtime guards notice. Three of them behave three different ways in a worklet scope: one removes your only diagnostics, one silently installs nothing, and one fires its failure action on every legitimate load.
Read article ›
Modules · New
2026-08-15
~10 min read
Obfuscation and import maps
An import map is JSON in your HTML, so no build step touches it and it stays as readable as you wrote it. Why module specifiers survive protection structurally, and what the map itself discloses about your module graph.
Read article ›
Threat Model · New
2026-08-15
~10 min read
Obfuscation and short-lived access tokens
An API key and an access token are different objects, and advice that fits one fits the other badly. What actually bounds a token is lifetime, rotation and sender-constraining, none of which a build step provides.
Read article ›
Compliance · New
2026-08-15
~9 min read
Obfuscation, export control and the encryption question
A transform that ships its decoder alongside the data withholds nothing, so it is not a cipher. Where real signing appears, and how a marketing word creates a classification problem.
Read article ›
Threat Model · New
2026-08-15
~9 min read
Can attackers diff your releases to find the fix?
Ship a client-side fix and both versions of the file are public. What per-build polymorphic output does to that comparison, the four workflows that want a fixed seed instead, and why the diff was never the only route.
Read article ›
Integration · New
2026-08-15
~9 min read
Your postMessage protocol is a public API
A message contract between your page and an embedded frame is a wire protocol anyone can watch and write to. The rename trap that breaks message keys silently, and the origin checks that are the actual control.
Read article ›
Build · New
2026-08-15
~9 min read
Your security scanner cannot read your protected bundle
Static analysis follows names and string values, and the transform removes both. Which of your three scanner families actually cares, and the build order that keeps each one honest.
Read article ›
Performance · New
2026-08-15
~10 min read
What runtime defense costs on the main thread
The transforms are cheap and the guards are not. The timer inventory at shipped defaults, why two wrappers forfeit cached compilation, and the verification that runs on every call into your bundle.
Read article ›
Threat model · New
2026-08-15
~8 min read
Your WebRTC credentials are in your bundle
A WebRTC client has to present TURN credentials to open a relay session, so a static credential in the bundle is a working, billable relay account. What protection changes, and the ephemeral pattern that fixes it.
Read article ›
Threat model · New
2026-08-15
~9 min read
Your random numbers run on their machine
A value generated in the browser is a value the user obtained first. Why crypto.getRandomValues fixes generator quality but not authority, and which draws have to move to the server.
Read article ›
Deployment · New
2026-08-15
~8 min read
Protected JavaScript behind a corporate proxy
In enterprise networks a TLS-inspecting appliance decrypts, scores and sometimes rewrites your bundle before the browser sees it. Why breakage is confined to one customer, and how to prove it with a digest.
Read article ›
Runtime Defense · New
2026-08-15
~9 min read
Your debug-protection timer fires on a backgrounded tab
The debugger-pause check measures the gap between timer ticks, and a browser throttling a hidden tab produces the same gap. The arithmetic behind the defaults, and how to tune it so it reports instead of breaking the page.
Read article ›
Compatibility · New
2026-08-15
~8 min read
Does obfuscation break cross-origin isolation?
Isolation is decided by response headers, which a code transform never emits. The real intersections are the hidden frame two runtime wrappers use for untampered built-ins, cross-origin delivery, and one timing check that is unaffected.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Can you lock JavaScript to a device?
Domain, browser and operating-system locks read values the client volunteered about itself, and two of them only compare two self-reported strings. What the guards do, why they fail rather than skip, and what binding actually requires.
Read article ›
Disclosure · New
2026-08-15
~9 min read
A bug bounty report says your obfuscated JavaScript was reversed
Recovering readable form from delivered JavaScript is not itself a vulnerability, and your policy should say so first. How to triage what the researcher actually found, and which findings deserve payment.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Your machine learning model is not obfuscated
Browser-side inference ships four things and only one of them is JavaScript you wrote. Why the weights file is never a candidate for the protection step, and which part of the pipeline is the real asset.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Will runtime defense block AI browser agents?
Agent extensions patch exactly the platform functions the integrity guard watches. What the default watch list contains, why pre-existing patching does not clear, and which failure action to choose.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Obfuscating htmx and Alpine apps: your logic is in the markup
An HTML attribute is not JavaScript, so the protector preserves it exactly and protects nothing in it. The renaming options that silently break an Alpine expression, and the exclusion list that prevents it.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Obfuscating ad tech JavaScript fights the channel that delivers it
A creative never runs on your hostname, so the domain lock fails before it reads the allowlist. Why the runtime guards misfire in a multi-party page, and what is genuinely worth protecting on the publisher side.
Read article ›
Compatibility · New
2026-08-15
~10 min read
Does obfuscation break islands and streaming SSR?
Some script on the page came from your build and some was written by the server moments before it arrived. What that means for hydration payloads, and the one failure mode that breaks these architectures.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Protecting WebUSB and Web Serial device code
The permission prompt is the security boundary, and obfuscation changes no authority at all. What is worth protecting in a hardware-facing web app, and why the real control belongs in the firmware.
Read article ›
Boundaries · New
2026-08-15
~10 min read
Your bot detection code runs on the bot
Anti-automation script is delivered to the machine it is meant to evaluate. Why the common bypass never reads your code, what per-build polymorphic output genuinely buys, and why a fixed seed is the wrong choice here.
Read article ›
Boundaries · New
2026-08-14
~9 min read
Your WebGL shaders are not obfuscated
A shader is not JavaScript. It is a string handed to another compiler and it must arrive intact, so it is recoverable at the API boundary in one step. Why excluding shader source from the string transforms is usually right.
Read article ›
Compatibility · New
2026-08-14
~9 min read
Does obfuscation change your browser support matrix?
A protector is a source-to-source transform, not a transpiler, so it emits the language level it read. Why there is no ECMAScript target option, what syntax the injected guards use, and the build order that keeps a wide matrix intact.
Read article ›
Runtime defense · New
2026-08-14
~9 min read
Your JavaScript expiry date runs on their clock
A date lock reads the local calendar on the user's own machine, with no network involved. What that makes it good for, what it cannot hold against, and how to pair it with a server-side deadline.
Read article ›
Compatibility · New
2026-08-14
~9 min read
Does obfuscation break internationalization?
Translated text is data and obfuscation transforms code, so in the usual setup nothing happens. The exceptions that matter: bundled catalogues, message lookup through renamed members, and extraction tooling run in the wrong order.
Read article ›
Build integration · New
2026-08-14
~9 min read
Obfuscating over-the-air JavaScript updates
A hot-pushed bundle is the same artifact the packager would have embedded. What is different is release management: why delta updates balloon under per-build renaming, and why signing the payload matters more than obscuring it.
Read article ›
Honest limits · New
2026-08-14
~9 min read
Obfuscation will not fix a client-side vulnerability
Renaming changes how a program reads; a vulnerability is what it does with untrusted input. Why XSS, prototype pollution and request forgery are unaffected, and how protection can quietly silence your own scanners.
Read article ›
Runtime defense · New
2026-08-14
~8 min read
Can you geo-restrict JavaScript in the browser?
No, and the reason is worth more than the feature: time zone and locale are settings, geolocation needs permission, and the IP address is only visible to your server. What the locks that do exist actually assert.
Read article ›
Architecture · New
2026-08-14
~8 min read
Your AI system prompt is in your bundle
The prompt, the tool definitions, the model routing and the guardrail list all ship to the browser. Why encrypting strings is friction rather than confidentiality, and what belongs server-side instead.
Read article ›
Browser Security · New
2026-08-14
~8 min read
Does obfuscation break Trusted Types?
Trusted Types closes DOM injection sinks, and protected output passes through enforcement cleanly with one narrow exception. Which two options emit an eval, and why the injected runtime modules are sink-free.
Read article ›
Third-Party Risk · New
2026-08-14
~9 min read
Obfuscation, tag managers and the scripts you do not control
The APIs analytics vendors wrap are almost exactly the APIs the anti-tamper guard watches, so your own marketing tags trip it. The default watch list in full, and what the script inventory detects.
Read article ›
API Security · New
2026-08-14
~9 min read
Obfuscation will not hide your GraphQL API
The query documents your client sends are protocol, not code style, so they travel in plain text however the bundle looks. What protection genuinely covers, which server-side controls do the work, and the member-renaming rule that keeps response handling intact.
Read article ›
Build Strategy · New
2026-08-14
~9 min read
Obfuscating a multi-tenant SaaS frontend: one build or one per tenant?
Per-tenant builds cost shared caching, a multiplied release matrix and per-build report retention, and buy distinguishability rather than protection. The three cases where they are genuinely right, and where tenant isolation actually lives.
Read article ›
Supply Chain · New
2026-08-14
~9 min read
Does obfuscation break your SBOM?
A lockfile-derived bill of materials is untouched by protection. An artifact scanner is broken completely by it — and so is any vulnerability scan pointed at the shipped bundle. How to tell which kind you have, and where each step belongs.
Read article ›
Media · New
2026-08-14
~10 min read
Can obfuscating your player stop video piracy?
Under Encrypted Media Extensions the key never reaches page script, so there is nothing in the player to hide. What streaming client code is genuinely worth protecting, and which controls actually move the number.
Read article ›
Workflow · New
2026-08-14
~9 min read
Should you obfuscate during development?
No — and the Vite and Next.js integrations already default to skipping it. But a protected build nobody has run until release day is the other failure mode. The four-tier arrangement that fixes both.
Read article ›
Delivery · New
2026-08-14
~10 min read
When your CDN rewrites your protected JavaScript
Protection is meant to be the last transformation — but CDN minifiers, script loaders and hosting plugins quietly add another one after the build. What breaks first, and the ten-minute digest check that names the culprit.
Read article ›
Realtime · New
2026-08-14
~9 min read
Your WebSocket protocol is in your bundle
Realtime clients ship the protocol and the frames are readable in DevTools regardless of the build step. Why every message needs server-side authorization, what protection genuinely covers, and why WebSocket sits on the anti-tamper watch list.
Read article ›
Node.js · New
2026-08-14
~8 min read
Compiling Node.js to a binary is not obfuscation
Single-executable builds embed your JavaScript as text and bytecode keeps the whole constant pool, so string literals and property names survive. What each tool removes, and the order to run packaging and protection.
Read article ›
Client-side data · New
2026-08-14
~8 min read
Obfuscation does not protect what you store in the browser
Protecting the code changes nothing about the values it writes. Why localStorage, IndexedDB and the Cache API stay readable, why encrypting in client code moves the problem, and what belongs in browser storage.
Read article ›
Web security · New
2026-08-14
~8 min read
Can someone put your protected app in an iframe?
Domain locking does not stop framing, because inside a frame your document still reports your own hostname. What frame-ancestors actually does, and the delivery contexts where an empty hostname fires the guard.
Read article ›
Authentication · New
2026-08-14
~8 min read
Obfuscation, passkeys and WebAuthn
A passkey private key never enters your JavaScript, so obfuscating the ceremony protects no credential. What is actually worth protecting in an authentication bundle, and why password managers trip the tamper guard.
Read article ›
Security & Risk · New
2026-08-14
~8 min read
Obfuscation does not stop an insider — and what actually does
A contractor with a repository clone holds the input to your build, not the output — comments, history and all. Where the boundary actually sits, the one thing in the toolchain that helps after a leak, and the controls that do the real work.
Read article ›
Legal & Compliance · New
2026-08-14
~8 min read
Obfuscation and trade secrets: does it help your legal case?
Trade-secret protection asks what reasonable measures you took — and a bundle sent to every visitor is a steep hill. Which logic to move server-side, what a protection run contributes as dated evidence, and where the argument stops.
Read article ›
Supply Chain · New
2026-08-14
~7 min read
Obfuscation will not stop a malicious dependency
Obfuscation defends the outbound direction. A poisoned package travels inbound and is in your bundle before protection runs — where the transforms hide it from your reviewers as well as from everyone else. The pipeline order that fixes it.
Read article ›
Architecture · New
2026-08-14
~8 min read
Obfuscating micro frontends and module federation
A host and a remote are separate builds, so they never share a generated mapping. What is actually on the cross-build contract, why member renaming is the sharp edge, and the report-per-remote trap that surfaces after the first production incident.
Read article ›
Runtime Integrity · New
2026-08-14
~8 min read
Can you stop browser extensions modifying your site?
No — an extension runs earlier and with more privilege than your page. But per-build polymorphic output breaks a targeted userscript on every release, which is better attrition than any detection feature. Why the right response is to degrade, not block.
Read article ›
Compatibility · New
2026-08-14
~8 min read
Does obfuscation break accessibility?
The transforms cannot touch the accessibility tree — ARIA, roles and label strings all survive. The risk is two runtime-defense options: one suppresses the context menu for everyone, the other mistakes an accessibility overlay for an attacker.
Read article ›
Product & Risk · New
2026-08-14
~8 min read
Your JavaScript bundle is leaking your roadmap
Feature flags ship the code weeks before the announcement, and a thirty-second search of your production bundle returns flag names, unreleased endpoints and UI copy — in your own vocabulary. What raises the cost, and what only server-side evaluation removes.
Read article ›
Architecture · New
2026-08-14
~8 min read
Should you compile to WebAssembly instead of obfuscating JavaScript?
It does make an algorithm harder to read. It also leaves your strings in a readable data section, your exports named, and your JavaScript glue in plain sight — so the license check you moved there is no harder to bypass.
Read article ›
Commercial · New
2026-08-14
~8 min read
Source code escrow and due diligence when your JavaScript is obfuscated
Escrow holds source; obfuscation is a build step, so they only conflict when someone deposits the wrong artifact. Plus the seeded rebuild that lets a verification agent prove the deposit really produces the shipped files.
Read article ›
Build & Delivery · New
2026-08-14
~8 min read
Testing obfuscated JavaScript: where protection belongs in your pipeline
Unit tests belong before protection and end-to-end tests belong after it — and a green pipeline that never executed the shipped bytes is the failure nobody notices. The assertions that break, and why snapshots need a seed.
Read article ›
Security Review · New
2026-08-14
~8 min read
Your security scan flagged obfuscated JavaScript. Now what?
Three findings wear the same words: an informational note, “we could not assess this”, and a genuine CWE-656 design problem. Read which one you got before writing a word — then close it with evidence.
Read article ›
Threat Model · New
2026-08-14
~8 min read
Can you disable DevTools and View Source?
No, and the reason tells you which alternatives are worth switching on. What debug protection, key blocking and self-defending output actually do, what they cost in support tickets, and the three things that genuinely work.
Read article ›
Threat Model · New
2026-08-14
~8 min read
Does obfuscation stop web scrapers?
A scraper reads your responses, not your source, and a headless browser runs protected code exactly as a real one does. There is one case where obfuscation is decisive — a request signature computed on the client — and it is the case worth spending on.
Read article ›
Deployment · New
2026-08-14
~8 min read
Obfuscation and long-term caching
Polymorphic output means unchanged source ships changed bytes, so every content hash moves and every returning visitor downloads everything again. Why pinning a seed forever is the wrong fix, and the per-release pattern that keeps both properties.
Read article ›
Engineering · New
2026-08-14
~8 min read
Obfuscating JavaScript in a monorepo
Protect the deployable, not the package. Why protecting an internal library double-processes your code, why there is no shared identifier map across runs, and how polymorphic output turns a task-runner cache into a permanent miss.
Read article ›
Engineering · New
2026-08-10
~7 min read
Does obfuscation break code splitting and dynamic imports?
Three concrete mistakes cause almost every broken lazy chunk: protecting chunks in separate passes, renaming files the bundler runtime looks up, and transforming strings the loader still reads. Each has a direct fix.
Read article ›
Deployment · New
2026-08-10
~7 min read
Obfuscation and Subresource Integrity
SRI verifies bytes and protection changes bytes, so ordering decides whether your script runs at all. Hash last, know why polymorphic output churns every hash, and use a seed when something downstream needs a stable one.
Read article ›
Correctness · New
2026-08-10
~8 min read
Obfuscating web components: the names the browser calls
The platform invokes connectedCallback by name and reads your options-object keys by name, and neither shows up as a caller in your source. Which names are contracts, and what is still safely protectable.
Read article ›
Engineering · New
2026-08-03
~7 min read
Does obfuscation break Web Workers and Service Workers?
A worker is a second entry point with its own global scope and no DOM. Here is what that changes about which transforms are safe, why postMessage keys are a contract, and how to test it in ten minutes.
Read article ›
Engineering · New
2026-08-03
~7 min read
Minify before or after obfuscation?
Bundle, minify, then protect — protection runs last. The two wrong orders fail differently, and one of them silently costs you tree shaking while looking perfectly fine.
Read article ›
Threat model · New
2026-08-03
~8 min read
Can browser DevTools deobfuscate your JavaScript?
Pretty-print is a formatter and reverses nothing that matters. The debugger is the real capability. An honest account of what an analyst gets from each, and the one mistake that undoes everything.
Read article ›
Distribution · New
2026-08-03
~8 min read
Should you obfuscate an npm package you publish?
Usually not — a published package is an input to someone else’s build, so you break their tree shaking and your own support workflow. The four cases where it is still right.
Read article ›
Performance · New
2026-08-02
~8 min read
How much bigger does obfuscation make your bundle?
We measured 42 real libraries. Raw output roughly doubles, while the compressed bytes users download grow much less. See the full results, the outliers, and why already-minified input behaves differently.
Read article ›
Engineering · New
2026-08-02
~7 min read
The newline rules that break JavaScript obfuscators
Five restricted productions make a line break change program meaning. These cases can produce valid output with silently wrong values, so they belong in every rewriting tool’s compatibility suite.
Read article ›
Correctness · New
2026-08-02
~7 min read
Does obfuscation preserve “use strict”?
String tables and wrappers can quietly demote a directive prologue. Here is what changes when strict mode is lost and a small runtime probe that verifies the protected result.
Read article ›
Engineering · New
2026-08-02
~6 min read
Obfuscating ES modules: what changes without a bundler
Export names are a public contract, not safe rename targets. Learn what remains protectable behind that module boundary and how to verify that protected .mjs files still link.
Read article ›
Fundamentals · New
2026-07-27
~8 min read
JavaScript obfuscation techniques explained
Obfuscation is not one thing — it is a stack of transforms with different costs. Identifier renaming, string arrays, encoding and encryption, cross-file member renaming, control-flow flattening, and bytecode virtualization: what each removes, what it costs at runtime, and where to apply it.
Read article ›
Troubleshooting · New
2026-07-27
~7 min read
Obfuscated JavaScript not working? The six causes, in order
It ran before protection and breaks after it. Nearly always one of six things — and the first one, a name matched as a string at runtime, accounts for most of them. How to find which, bisect the transforms, and build a repro worth sending.
Read article ›
Operations · New
2026-07-27
~6 min read
How to debug obfuscated JavaScript in production
Don’t ship the source map. Keep each build’s identifier map private, translate field stack traces locally with jso-symbolicate, and run captured Sentry or Datadog events through the matching adapter — no upload, no key in the browser.
Read article ›
Source handling · New
2026-07-27
~6 min read
Is it safe to use an online JavaScript obfuscator?
A textarea is not a sandbox — pasting is uploading. The ten-second Network-tab test that settles it for any vendor, the questions a security reviewer will ask you, and when to move to CI or a local workflow instead.
Read article ›
Design guidance · New
2026-07-27
~7 min read
How to protect a JavaScript licence or trial check
One boolean stands between your paid product and a free one. Move authority to the server, virtualize the validation path, stop concentrating the decision in a single flag, and instrument tampering so a bypass surfaces in a week rather than never.
Read article ›
Legal & Licensing · New
2026-07-21
~5 min read
Is JavaScript obfuscation legal?
Yes — obfuscating code you own or are licensed to modify is legal and routine. The real constraints aren’t obfuscation itself: honor third-party and copyleft (GPL) license terms, respect publishing rules (browser-extension stores forbid it), and remember obfuscation never launders illegal behavior.
Read article ›
Fundamentals · New
2026-07-21
~5 min read
Obfuscation vs encryption: what’s the difference?
Not the same thing. Encryption needs a key to run and is reversible with it; obfuscation runs directly and only raises the cost of understanding. Anything that “encrypts” client-side JavaScript must ship the key to the browser — so it’s really obfuscation with extra steps.
Read article ›
Deployment hygiene · New
2026-07-21
~6 min read
Why does obfuscated JavaScript trigger antivirus false positives?
Because malware pioneered the same techniques — string arrays, eval loaders, packed blobs — so heuristics fire on the shape, not the intent. How to ship protected code that doesn’t get quarantined: avoid eval, serve external files, sign your builds, keep behavior transparent.
Read article ›
SEO · New
2026-07-19
~5 min read
Does obfuscating JavaScript hurt your SEO?
No — Google indexes the rendered page, not your source, so behavior-preserving obfuscation is SEO-neutral. The real rules: keep JSON-LD structured data readable (it’s data, not code), don’t bloat the bundle (Core Web Vitals), don’t block your JS from crawlers, and verify the rendered DOM is unchanged.
Read article ›
Security engineering · New
2026-07-19
~5 min read
Does obfuscation break Content Security Policy?
Old eval-based packers break strict CSP; modern obfuscation doesn’t. String decoding, control-flow flattening, and VM bytecode are ordinary code — no eval, no new Function — so protected output runs under a strict CSP without unsafe-eval. Serve it as an external file and keep your policy strict.
Read article ›
Engineering · New
2026-07-27
~7 min read
How to verify an obfuscator didn’t silently break your JavaScript
Output that parses is not output that works. Arrow functions lose their this, a unary minus fuses into a decrement, a tagged template stops calling its tag — all valid syntax, all wrong answers. A four-rung verification ladder, what each rung can and cannot see, and why diffing against the original beats testing against expectations you wrote yourself.
Read article ›
Performance · New
2026-07-19
~5 min read
Does JavaScript obfuscation slow down your app?
A little, and it’s controllable. Identifier renaming is essentially free; VM bytecode is meaningfully slower by design. The whole game is matching transform strength to hot vs cold paths — protect the once-per-session license check hard, keep the per-frame loop light, and the cost disappears where it matters.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
Is JavaScript obfuscation reversible?
Yes, in principle — obfuscation isn’t encryption, and code that runs can be understood. But that’s the wrong question. What it actually does is raise the cost of reversing; the goal is to price the attacker you have out of reach. The reversal-cost spectrum, where AI/deobfuscators fit, and why measurable resistance beats an “irreversible” claim.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
You can’t hide an API key in JavaScript
A secret shipped to the browser is already public — the browser has to read it, so anyone can. Obfuscation raises the cost of finding a client-side key but can’t make it secret. What actually works (keep it server-side), the NEXT_PUBLIC_ trap, and where obfuscation genuinely helps: your logic, not your secrets.
Read article ›
Deployment hygiene · New
2026-07-19
~5 min read
Your source maps are publishing your source code
A .js.map maps your shipped bundle back to original names — and with inlineSources, the original source text. Ship one beside a protected bundle and you have published exactly what you protected. How to check what you serve right now, why it keeps happening by default, and the one-line deploy fix.
Read article ›
Supply-chain integrity · Shipped
2026-05-28
~7 min read
Watermarks + signed attestations for protected JavaScript
HMAC-SHA256 watermarks that survive every obfuscation transform, Ed25519-signed release attestations with two-stage verify, pre-flight quota gates, bulk forensic scanner. Cross-language verified across Node, Python, and .NET. Wire format is open. Six lines of GitHub Action YAML covers the whole stack.
Read article ›
JSO AI · Phase 1 shipped
Updated 2026-06-06
~5 min read
JSO AI previews and BYO keys are live
Four endpoints, three browser previews, encrypted OpenAI / Claude account keys, Prometheus usage export, JSON Schema, language client snippets, and RSS. Preview mode works without a key; BYO keys turn the same endpoints into live AI for that account.
Read article ›
Maximum Mode · VM Bytecode Beta
Updated 2026-06-06
~8 min read
VM-based protection for selected sensitive functions
Eligible Corporate+ accounts can test bytecode virtualization for small pieces of high-value JavaScript. The design tradeoffs and why it is opt-in per function rather than whole-bundle default.
Read article ›
AI-Aware Research
2026-05-20
~10 min read
CASCADE and the LLM-deobfuscator question
Google’s CASCADE pairs Gemini with a JavaScript IR to deobfuscate at scale. What the paper actually does, where per-build polymorphism alone falls short against prelude-detection, and what’s on the JSO roadmap to answer it.
Read article ›
Resistance Score · Planned
2026-05-20
~8 min read
The Resistance Score: planned evidence for AI-resistance claims
Every obfuscator markets “AI-resistant,” almost none ship a way to check it. The artifact JSO is designing to make the claim reviewable: a named adversarial probe, a source-free report, and recovery categories.
Read article ›
AI-Aware Research
2026-04-25
~9 min read
Can ChatGPT, Claude, or Copilot reverse-engineer obfuscated JavaScript?
A direct technical answer for 2026. What today’s AI assistants can actually deobfuscate, where they break down structurally, and why per-build polymorphic decoders disrupt the pattern-matching approach LLMs rely on.
Read article ›
Vendor Analysis
2026-04-26
~10 min read
JavaScript VM protection compared: Jscrambler, JSDefender, Verimatrix, OSS virtualizers
Vendor-by-vendor analysis of JavaScript bytecode VM protection — what each product actually ships, how the open-source virtualizers compare, and where selective virtualization fits against whole-bundle approaches.
Read article ›
Runtime Boundaries · New
2026-08-15
~10 min read
Should you obfuscate an edge function?
Code that never reaches a browser has a different adversary. Which runtime guards fail closed with no DOM, why the evaluation-based wrappers are skipped for module source, and the one case where the answer is yes.
Read article ›
What Ships With Your Code · New
2026-08-15
~10 min read
Your pricing logic is in your bundle
Discount tiers and eligibility rules computed in the browser fail twice: they disclose how you price, and they let the customer choose the number. What protection helps with and what it cannot touch.
Read article ›
Build Pipeline Hygiene · New
2026-08-15
~9 min read
Keeping open-source license notices in a protected build
Permissive licenses ask you to preserve attribution notices in what you distribute, and comment removal deletes them. Only the run of comments above the first statement survives, which decides the whole strategy.
Read article ›
Where Authority Lives · New
2026-08-15
~9 min read
Your JavaScript cannot authenticate a payment
Strong customer authentication is a claim about who verified the payer, and a browser is not in a position to make it. Why dynamic linking belongs where the amount is authoritative, and where the checkout risk actually sits.
Read article ›