Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 205–216 of 256

Security & Risk · New 2026-08-14 ~8 min read

Obfuscation does not stop an insider — and what actually does

A contractor with a repository clone holds the input to your build, not the output — comments, history and all. Where the boundary actually sits, the one thing in the toolchain that helps after a leak, and the controls that do the real work.

Read article ›
Legal & Compliance · New 2026-08-14 ~8 min read

Obfuscation and trade secrets: does it help your legal case?

Trade-secret protection asks what reasonable measures you took — and a bundle sent to every visitor is a steep hill. Which logic to move server-side, what a protection run contributes as dated evidence, and where the argument stops.

Read article ›
Supply Chain · New 2026-08-14 ~7 min read

Obfuscation will not stop a malicious dependency

Obfuscation defends the outbound direction. A poisoned package travels inbound and is in your bundle before protection runs — where the transforms hide it from your reviewers as well as from everyone else. The pipeline order that fixes it.

Read article ›
Architecture · New 2026-08-14 ~8 min read

Obfuscating micro frontends and module federation

A host and a remote are separate builds, so they never share a generated mapping. What is actually on the cross-build contract, why member renaming is the sharp edge, and the report-per-remote trap that surfaces after the first production incident.

Read article ›
Runtime Integrity · New 2026-08-14 ~8 min read

Can you stop browser extensions modifying your site?

No — an extension runs earlier and with more privilege than your page. But per-build polymorphic output breaks a targeted userscript on every release, which is better attrition than any detection feature. Why the right response is to degrade, not block.

Read article ›
Compatibility · New 2026-08-14 ~8 min read

Does obfuscation break accessibility?

The transforms cannot touch the accessibility tree — ARIA, roles and label strings all survive. The risk is two runtime-defense options: one suppresses the context menu for everyone, the other mistakes an accessibility overlay for an attacker.

Read article ›
Product & Risk · New 2026-08-14 ~8 min read

Your JavaScript bundle is leaking your roadmap

Feature flags ship the code weeks before the announcement, and a thirty-second search of your production bundle returns flag names, unreleased endpoints and UI copy — in your own vocabulary. What raises the cost, and what only server-side evaluation removes.

Read article ›
Architecture · New 2026-08-14 ~8 min read

Should you compile to WebAssembly instead of obfuscating JavaScript?

It does make an algorithm harder to read. It also leaves your strings in a readable data section, your exports named, and your JavaScript glue in plain sight — so the license check you moved there is no harder to bypass.

Read article ›
Commercial · New 2026-08-14 ~8 min read

Source code escrow and due diligence when your JavaScript is obfuscated

Escrow holds source; obfuscation is a build step, so they only conflict when someone deposits the wrong artifact. Plus the seeded rebuild that lets a verification agent prove the deposit really produces the shipped files.

Read article ›
Build & Delivery · New 2026-08-14 ~8 min read

Testing obfuscated JavaScript: where protection belongs in your pipeline

Unit tests belong before protection and end-to-end tests belong after it — and a green pipeline that never executed the shipped bytes is the failure nobody notices. The assertions that break, and why snapshots need a seed.

Read article ›
Security Review · New 2026-08-14 ~8 min read

Your security scan flagged obfuscated JavaScript. Now what?

Three findings wear the same words: an informational note, “we could not assess this”, and a genuine CWE-656 design problem. Read which one you got before writing a word — then close it with evidence.

Read article ›
Threat Model · New 2026-08-14 ~8 min read

Can you disable DevTools and View Source?

No, and the reason tells you which alternatives are worth switching on. What debug protection, key blocking and self-defending output actually do, what they cost in support tickets, and the three things that genuinely work.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators