Threat modeling · New
2026-07-19
~5 min read
Is JavaScript obfuscation reversible?
Yes, in principle — obfuscation isn’t encryption, and code that runs can be understood. But that’s the wrong question. What it actually does is raise the cost of reversing; the goal is to price the attacker you have out of reach. The reversal-cost spectrum, where AI/deobfuscators fit, and why measurable resistance beats an “irreversible” claim.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
You can’t hide an API key in JavaScript
A secret shipped to the browser is already public — the browser has to read it, so anyone can. Obfuscation raises the cost of finding a client-side key but can’t make it secret. What actually works (keep it server-side), the NEXT_PUBLIC_ trap, and where obfuscation genuinely helps: your logic, not your secrets.
Read article ›
Deployment hygiene · New
2026-07-19
~5 min read
Your source maps are publishing your source code
A .js.map maps your shipped bundle back to original names — and with inlineSources, the original source text. Ship one beside a protected bundle and you have published exactly what you protected. How to check what you serve right now, why it keeps happening by default, and the one-line deploy fix.
Read article ›
Supply-chain integrity · Shipped
2026-05-28
~7 min read
Watermarks + signed attestations for protected JavaScript
HMAC-SHA256 watermarks that survive every obfuscation transform, Ed25519-signed release attestations with two-stage verify, pre-flight quota gates, bulk forensic scanner. Cross-language verified across Node, Python, and .NET. Wire format is open. Six lines of GitHub Action YAML covers the whole stack.
Read article ›
JSO AI · Phase 1 shipped
Updated 2026-06-06
~5 min read
JSO AI previews and BYO keys are live
Four endpoints, three browser previews, encrypted OpenAI / Claude account keys, Prometheus usage export, JSON Schema, language client snippets, and RSS. Preview mode works without a key; BYO keys turn the same endpoints into live AI for that account.
Read article ›
Maximum Mode · VM Bytecode Beta
Updated 2026-06-06
~8 min read
VM-based protection for selected sensitive functions
Eligible Corporate+ accounts can test bytecode virtualization for small pieces of high-value JavaScript. The design tradeoffs and why it is opt-in per function rather than whole-bundle default.
Read article ›
AI-Aware Research
2026-05-20
~10 min read
CASCADE and the LLM-deobfuscator question
Google’s CASCADE pairs Gemini with a JavaScript IR to deobfuscate at scale. What the paper actually does, where per-build polymorphism alone falls short against prelude-detection, and what’s on the JSO roadmap to answer it.
Read article ›
Resistance Score · Planned
2026-05-20
~8 min read
The Resistance Score: planned evidence for AI-resistance claims
Every obfuscator markets “AI-resistant,” almost none ship a way to check it. The artifact JSO is designing to make the claim reviewable: a named adversarial probe, a source-free report, and recovery categories.
Read article ›
AI-Aware Research
2026-04-25
~9 min read
Can ChatGPT, Claude, or Copilot reverse-engineer obfuscated JavaScript?
A direct technical answer for 2026. What today’s AI assistants can actually deobfuscate, where they break down structurally, and why per-build polymorphic decoders disrupt the pattern-matching approach LLMs rely on.
Read article ›