Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 181–192 of 256

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break islands and streaming SSR?

Some script on the page came from your build and some was written by the server moments before it arrived. What that means for hydration payloads, and the one failure mode that breaks these architectures.

Read article ›
Boundaries · New 2026-08-15 ~10 min read

Protecting WebUSB and Web Serial device code

The permission prompt is the security boundary, and obfuscation changes no authority at all. What is worth protecting in a hardware-facing web app, and why the real control belongs in the firmware.

Read article ›
Boundaries · New 2026-08-15 ~10 min read

Your bot detection code runs on the bot

Anti-automation script is delivered to the machine it is meant to evaluate. Why the common bypass never reads your code, what per-build polymorphic output genuinely buys, and why a fixed seed is the wrong choice here.

Read article ›
Boundaries · New 2026-08-14 ~9 min read

Your WebGL shaders are not obfuscated

A shader is not JavaScript. It is a string handed to another compiler and it must arrive intact, so it is recoverable at the API boundary in one step. Why excluding shader source from the string transforms is usually right.

Read article ›
Compatibility · New 2026-08-14 ~9 min read

Does obfuscation change your browser support matrix?

A protector is a source-to-source transform, not a transpiler, so it emits the language level it read. Why there is no ECMAScript target option, what syntax the injected guards use, and the build order that keeps a wide matrix intact.

Read article ›
Runtime defense · New 2026-08-14 ~9 min read

Your JavaScript expiry date runs on their clock

A date lock reads the local calendar on the user's own machine, with no network involved. What that makes it good for, what it cannot hold against, and how to pair it with a server-side deadline.

Read article ›
Compatibility · New 2026-08-14 ~9 min read

Does obfuscation break internationalization?

Translated text is data and obfuscation transforms code, so in the usual setup nothing happens. The exceptions that matter: bundled catalogues, message lookup through renamed members, and extraction tooling run in the wrong order.

Read article ›
Build integration · New 2026-08-14 ~9 min read

Obfuscating over-the-air JavaScript updates

A hot-pushed bundle is the same artifact the packager would have embedded. What is different is release management: why delta updates balloon under per-build renaming, and why signing the payload matters more than obscuring it.

Read article ›
Honest limits · New 2026-08-14 ~9 min read

Obfuscation will not fix a client-side vulnerability

Renaming changes how a program reads; a vulnerability is what it does with untrusted input. Why XSS, prototype pollution and request forgery are unaffected, and how protection can quietly silence your own scanners.

Read article ›
Runtime defense · New 2026-08-14 ~8 min read

Can you geo-restrict JavaScript in the browser?

No, and the reason is worth more than the feature: time zone and locale are settings, geolocation needs permission, and the IP address is only visible to your server. What the locks that do exist actually assert.

Read article ›
Architecture · New 2026-08-14 ~8 min read

Your AI system prompt is in your bundle

The prompt, the tool definitions, the model routing and the guardrail list all ship to the browser. Why encrypting strings is friction rather than confidentiality, and what belongs server-side instead.

Read article ›
Browser Security · New 2026-08-14 ~8 min read

Does obfuscation break Trusted Types?

Trusted Types closes DOM injection sinks, and protected output passes through enforcement cleanly with one narrow exception. Which two options emit an eval, and why the injected runtime modules are sink-free.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators