Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 145–156 of 256

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break this binding?

Renaming identifiers cannot move a receiver, because this is fixed by the shape of the call site rather than by any name. Methods, arrows, call, apply and bind all measured identical after protection.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break switch statements and string comparison?

The string table replaces literals with calls that return the same primitive strings, so strict equality, switch matching and fallthrough keep working. Measured with MoveStrings and EncodeStrings enabled.

Read article ›
What survives · New 2026-08-15 ~10 min read

Does obfuscation break sparse arrays and sort order?

Array holes stay holes, sort stays stable, and length keeps truncating, because array shape is runtime state that the transforms have no syntax to reach.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break getters and setters?

Accessor properties come through protection intact: the getter still computes, the setter still runs its side effect, and the property descriptor still reports enumerable. The one thing that moves is the accessor name.

Read article ›
What survives · New 2026-08-15 ~10 min read

Does obfuscation change object key order?

Key enumeration order is a specified property of JavaScript objects, and protection preserves it exactly: integer-like keys first, then string keys in insertion order, with Object.keys, for...in and JSON.stringify all agreeing.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break modern JavaScript operators?

Logical assignment, exponentiation, numeric separators and optional catch binding all come through with identical behaviour on both target versions, including the ES5 path that rewrites several of them into older syntax.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break async and await?

Async functions keep their exact ordering through protection: synchronous code still runs first, microtasks still run in the right place, and a rejected promise is still caught by the try/catch around it.

Read article ›
What survives · New 2026-08-15 ~10 min read

Your regular expressions are not obfuscated

A regular expression literal comes out of protection byte for byte identical to the way you wrote it. Named capture groups, lookbehind and Unicode property escapes are all still there in the shipped bundle.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break BigInt and large integer IDs?

BigInt literals, hex BigInt literals and values built with BigInt() all survive protection unchanged. The real hazard with large identifiers was already in your source before you protected anything.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break labeled statements?

Labels and their break and continue targets survive protection in both output targets, including through the rewrite that changes the shape of the loop they label.

Read article ›
What survives · New 2026-08-15 ~10 min read

What JavaScript obfuscation does not rename

An inventory of the things that come out of protection with their original text intact: regex literals, import specifiers, bracket-access keys, label names, private member names and exported names.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break Proxy, Reflect and defineProperty?

Member renaming rewrites dotted access and object-literal keys. It never rewrites a property name you hand to an API as a string, and that one asymmetry explains every metaprogramming failure people report.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators