Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 217–228 of 256

Threat Model · New 2026-08-14 ~8 min read

Does obfuscation stop web scrapers?

A scraper reads your responses, not your source, and a headless browser runs protected code exactly as a real one does. There is one case where obfuscation is decisive — a request signature computed on the client — and it is the case worth spending on.

Read article ›
Deployment · New 2026-08-14 ~8 min read

Obfuscation and long-term caching

Polymorphic output means unchanged source ships changed bytes, so every content hash moves and every returning visitor downloads everything again. Why pinning a seed forever is the wrong fix, and the per-release pattern that keeps both properties.

Read article ›
Engineering · New 2026-08-14 ~8 min read

Obfuscating JavaScript in a monorepo

Protect the deployable, not the package. Why protecting an internal library double-processes your code, why there is no shared identifier map across runs, and how polymorphic output turns a task-runner cache into a permanent miss.

Read article ›
Engineering · New 2026-08-10 ~7 min read

Does obfuscation break code splitting and dynamic imports?

Three concrete mistakes cause almost every broken lazy chunk: protecting chunks in separate passes, renaming files the bundler runtime looks up, and transforming strings the loader still reads. Each has a direct fix.

Read article ›
Deployment · New 2026-08-10 ~7 min read

Obfuscation and Subresource Integrity

SRI verifies bytes and protection changes bytes, so ordering decides whether your script runs at all. Hash last, know why polymorphic output churns every hash, and use a seed when something downstream needs a stable one.

Read article ›
Correctness · New 2026-08-10 ~8 min read

Obfuscating web components: the names the browser calls

The platform invokes connectedCallback by name and reads your options-object keys by name, and neither shows up as a caller in your source. Which names are contracts, and what is still safely protectable.

Read article ›
Engineering · New 2026-08-03 ~7 min read

Does obfuscation break Web Workers and Service Workers?

A worker is a second entry point with its own global scope and no DOM. Here is what that changes about which transforms are safe, why postMessage keys are a contract, and how to test it in ten minutes.

Read article ›
Engineering · New 2026-08-03 ~7 min read

Minify before or after obfuscation?

Bundle, minify, then protect — protection runs last. The two wrong orders fail differently, and one of them silently costs you tree shaking while looking perfectly fine.

Read article ›
Threat model · New 2026-08-03 ~8 min read

Can browser DevTools deobfuscate your JavaScript?

Pretty-print is a formatter and reverses nothing that matters. The debugger is the real capability. An honest account of what an analyst gets from each, and the one mistake that undoes everything.

Read article ›
Distribution · New 2026-08-03 ~8 min read

Should you obfuscate an npm package you publish?

Usually not — a published package is an input to someone else’s build, so you break their tree shaking and your own support workflow. The four cases where it is still right.

Read article ›
Performance · New 2026-08-02 ~8 min read

How much bigger does obfuscation make your bundle?

We measured 42 real libraries. Raw output roughly doubles, while the compressed bytes users download grow much less. See the full results, the outliers, and why already-minified input behaves differently.

Read article ›
Engineering · New 2026-08-02 ~7 min read

The newline rules that break JavaScript obfuscators

Five restricted productions make a line break change program meaning. These cases can produce valid output with silently wrong values, so they belong in every rewriting tool’s compatibility suite.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators