Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 49–60 of 256

Browser security headers · New 2026-08-16 ~10 min read

Does obfuscation break Content-Security-Policy headers?

Measured: renaming the keys of a CSP policy object serialises those names straight into the header, where a browser silently ignores every directive it does not recognise - so the header is present, the response is 200, and nothing is enforced.

Read article ›
Cross-origin access · New 2026-08-16 ~10 min read

Does obfuscation break CORS policy options?

Measured: renaming the origin key of a CORS options object reverts the middleware to its documented default of a wildcard, so an origin allowlist becomes Access-Control-Allow-Origin star with no error and no failing request.

Read article ›
Abuse prevention · New 2026-08-16 ~10 min read

Does obfuscation break rate limiter configuration?

Measured: renaming the window, the ceiling or the key function of a login rate limiter silently multiplies the password guesses an attacker gets, and renaming the limiter's own result fields disables blocking entirely with no error.

Read article ›
Supply chain · New 2026-08-16 ~10 min read

Does obfuscation break archive extraction guards?

Measured: renaming the filter option on an archive extraction removes the allowlist from the pipeline entirely, so an environment file, a shell script and a path outside the target directory were all written - and renaming the byte cap wrote forty megabytes where zero belonged.

Read article ›
Cryptography · New 2026-08-16 ~10 min read

Does obfuscation break key generation and signing options?

Measured: member renaming can strip the cipher and passphrase from a private key export, so the key lands on disk unencrypted with no error, and it can silently downgrade an RSA-PSS signature to PKCS#1 v1.5.

Read article ›
Data Layer · New 2026-08-16 ~10 min read

Does obfuscation break embedded database options?

Measured against node:sqlite: renaming readOnly turned a reporting connection writable and a stray UPDATE landed on the ledger, while renaming a relaxed foreign-key switch broke a bulk import that had been working.

Read article ›
Input Validation · New 2026-08-16 ~10 min read

Does obfuscation break mass assignment guards?

Measured with class-validator: renaming the whitelist option let an isAdmin flag from the request body reach the entity, and the same rename turned the request that should have been rejected into a silent success.

Read article ›
Observability · New 2026-08-16 ~10 min read

Does obfuscation break log redaction?

Measured with util.inspect: renaming the depth and string-length switches put a full session token into a log line that had been 54 characters, and renaming a name your own code owns changed the field name in the log itself.

Read article ›
Authentication · New 2026-08-16 ~10 min read

Does obfuscation break token verification rules?

Measured with jose: renaming the issuer, audience, algorithms, required-claims and max-age keys in a verification policy admitted five tokens that had been refused, and renaming the whole policy object admitted every one of them.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break TLS and Certificate Options?

A TLS connection is configured through an options object whose names node fixes. Protection alone is clean on all five profiles. Member renaming silently downgraded a service that pins TLS 1.3 onto TLS 1.2, let an anonymous client hold a session on a server that requires client certificates, and dropped the cipher pin, the ALPN protocol and the SNI name without an error anywhere.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Sandbox and VM Options?

A sandbox is only as strong as the options object that configures it. Protection alone is clean on all five profiles. Member renaming let a runaway plugin run to completion against a 60 millisecond budget, re-enabled code generation from strings inside the sandbox, returned control while the plugin was still pending, and erased the tenant name from the incident frame.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Compression Options?

Compression levels, output caps and window sizes are properties on an options object the zlib bindings read. Protection alone is clean on all five profiles. Member renaming removed the cap that stops a decompression bomb, so a 24 kilobyte upload expanded to 24 megabytes and was accepted, and it turned a deliberately cheap compression path into the expensive default.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators