Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 157–168 of 256

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break cross-tab messaging?

BroadcastChannel, SharedWorker and Web Locks coordinate several tabs of the same app. Two of the three carry property names between contexts, and the tabs are not always running the same build.

Read article ›
Diagnostics · New 2026-08-15 ~10 min read

Profiling and memory leaks in obfuscated JavaScript

Symbolication restores a stack trace. It does not restore a heap snapshot or a CPU profile, because those read names out of live objects rather than out of an error, and no mapping file is consulted.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break class private fields?

A private name is not a property name, and the engine has to treat it as its own kind of thing. Why hash-prefixed members are skipped by the member transform, why they stop a class being downlevelled, and the one class-field case that used to fail silently.

Read article ›
Browser Platform · New 2026-08-15 ~10 min read

Obfuscation and Permissions-Policy

Permissions-Policy is a header, so nothing in your bundle can edit it and an attacker holding your code cannot grant themselves a capability. It is also a common cause of failures that get blamed on the obfuscator.

Read article ›
Third-Party Scripts · New 2026-08-15 ~10 min read

Obfuscation and cross-site cookie access

If your script runs on other people's pages, its cookie access is a functional dependency that browsers are steadily restricting. Obfuscation neither helps nor hinders the migration, but it does change how you debug it.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break audio and paint worklets?

A worklet does not run in the window, and the runtime guards notice. Three of them behave three different ways in a worklet scope: one removes your only diagnostics, one silently installs nothing, and one fires its failure action on every legitimate load.

Read article ›
Modules · New 2026-08-15 ~10 min read

Obfuscation and import maps

An import map is JSON in your HTML, so no build step touches it and it stays as readable as you wrote it. Why module specifiers survive protection structurally, and what the map itself discloses about your module graph.

Read article ›
Threat Model · New 2026-08-15 ~10 min read

Obfuscation and short-lived access tokens

An API key and an access token are different objects, and advice that fits one fits the other badly. What actually bounds a token is lifetime, rotation and sender-constraining, none of which a build step provides.

Read article ›
Compliance · New 2026-08-15 ~9 min read

Obfuscation, export control and the encryption question

A transform that ships its decoder alongside the data withholds nothing, so it is not a cipher. Where real signing appears, and how a marketing word creates a classification problem.

Read article ›
Threat Model · New 2026-08-15 ~9 min read

Can attackers diff your releases to find the fix?

Ship a client-side fix and both versions of the file are public. What per-build polymorphic output does to that comparison, the four workflows that want a fixed seed instead, and why the diff was never the only route.

Read article ›
Integration · New 2026-08-15 ~9 min read

Your postMessage protocol is a public API

A message contract between your page and an embedded frame is a wire protocol anyone can watch and write to. The rename trap that breaks message keys silently, and the origin checks that are the actual control.

Read article ›
Build · New 2026-08-15 ~9 min read

Your security scanner cannot read your protected bundle

Static analysis follows names and string values, and the transform removes both. Which of your three scanner families actually cares, and the build order that keeps each one honest.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators