Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

More research and roadmap

Newest first

Articles 97–108 of 256

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Async Iteration?

The article on async and await explicitly declined to cover for await and async generators, and the article on iterators and generators found a real defect in the synchronous protocol. This one measures the asynchronous half: ordering, interleaving, early exit, cleanup, delegation and rejection all survive on every profile, including the target where synchronous for-of does not.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Your State Management Store?

Action types, payloads, reducers and selectors all survive member renaming, because both halves of every one of those contracts live in your own code. The state that leaves your process does not, and one very ordinary field name collides with a built-in array method.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break i18n Message Catalogs?

Two catalogs with identical content, one written as a JavaScript object and one loaded as data. Under member renaming the first shows users raw message keys and the second is untouched. The interpolation parameters break both, which is why the obvious mitigation is only half a fix.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Iterators and Generators?

Four other articles on this site defer to this one, and they are right to. The ES5 output target rewrites a for-of loop over a generator, and until 20 September 2026 that rewrite drained the generator completely before your loop body ran even once -- the values correct and almost everything else about the loop not. The default now steps the iterator lazily and performs the cleanup call. This page records both the measurement and the fix.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Iterator Helpers?

A lazy chain of map, filter, take and toArray over an infinite generator came through five protection configurations byte-identical, laziness included. What breaks is member renaming, and the boundary is sharp: helper chains over built-in sources survive renaming the iteration protocol, while the same chain over an iterable you wrote does not.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Set Operations?

Union, intersection, difference and the subset predicates came through five protection configurations unchanged. The measured failure is a set-like object of your own: the platform reads size, has and keys off it by name, and renaming one of them produced an error message that names a property sitting in plain sight in your source.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Memoization and Caches?

Memoization, string cache keys and an LRU with its own bookkeeping all came through five protection configurations unchanged. Then one renamed property stopped the eviction step without stopping the counter that reports it, so the cache grew past its limit while its own metrics said it had evicted.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break fetch and Request Options?

A POST with headers, a body and a redirect policy came through five protection configurations byte-identical. What breaks is member renaming reaching the init dictionary, and the sharpest measured case is a POST that the platform rejects as a GET while your source still plainly reads POST.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Abort Signals and Cancellation?

AbortController, its signal, its reason and a timeout signal all survived five protection configurations unchanged. Member renaming produces the worst possible failure for a cancellation primitive: a guard that always reports the work was not cancelled, with nothing thrown and nothing logged.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break addEventListener Options?

Event registration, dispatch and custom event payloads survived five protection configurations unchanged. Member renaming reaching the options dictionary produced the measured result that a once-only listener fired on every dispatch and an aborted listener kept running, with nothing thrown.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break TextEncoder and TextDecoder?

Encoding and decoding, including accented text, an em dash and a byte order mark, came through five protection configurations unchanged. Member renaming reaching the decoder options turned a validating decoder into a permissive one and corrupted a character split across two streamed chunks.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Intl and Locale Formatting?

Currency, date, plural and collation formatting came through five protection configurations byte-identical. The break is member renaming reaching the options object, and it does not throw: a currency amount quietly formats as a plain decimal and a date lands on the wrong calendar day.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.