Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 169–180 of 256

Performance · New 2026-08-15 ~10 min read

What runtime defense costs on the main thread

The transforms are cheap and the guards are not. The timer inventory at shipped defaults, why two wrappers forfeit cached compilation, and the verification that runs on every call into your bundle.

Read article ›
Threat model · New 2026-08-15 ~8 min read

Your WebRTC credentials are in your bundle

A WebRTC client has to present TURN credentials to open a relay session, so a static credential in the bundle is a working, billable relay account. What protection changes, and the ephemeral pattern that fixes it.

Read article ›
Threat model · New 2026-08-15 ~9 min read

Your random numbers run on their machine

A value generated in the browser is a value the user obtained first. Why crypto.getRandomValues fixes generator quality but not authority, and which draws have to move to the server.

Read article ›
Deployment · New 2026-08-15 ~8 min read

Protected JavaScript behind a corporate proxy

In enterprise networks a TLS-inspecting appliance decrypts, scores and sometimes rewrites your bundle before the browser sees it. Why breakage is confined to one customer, and how to prove it with a digest.

Read article ›
Runtime Defense · New 2026-08-15 ~9 min read

Your debug-protection timer fires on a backgrounded tab

The debugger-pause check measures the gap between timer ticks, and a browser throttling a hidden tab produces the same gap. The arithmetic behind the defaults, and how to tune it so it reports instead of breaking the page.

Read article ›
Compatibility · New 2026-08-15 ~8 min read

Does obfuscation break cross-origin isolation?

Isolation is decided by response headers, which a code transform never emits. The real intersections are the hidden frame two runtime wrappers use for untampered built-ins, cross-origin delivery, and one timing check that is unaffected.

Read article ›
Boundaries · New 2026-08-15 ~10 min read

Can you lock JavaScript to a device?

Domain, browser and operating-system locks read values the client volunteered about itself, and two of them only compare two self-reported strings. What the guards do, why they fail rather than skip, and what binding actually requires.

Read article ›
Disclosure · New 2026-08-15 ~9 min read

A bug bounty report says your obfuscated JavaScript was reversed

Recovering readable form from delivered JavaScript is not itself a vulnerability, and your policy should say so first. How to triage what the researcher actually found, and which findings deserve payment.

Read article ›
Boundaries · New 2026-08-15 ~10 min read

Your machine learning model is not obfuscated

Browser-side inference ships four things and only one of them is JavaScript you wrote. Why the weights file is never a candidate for the protection step, and which part of the pipeline is the real asset.

Read article ›
Compatibility · New 2026-08-15 ~10 min read

Will runtime defense block AI browser agents?

Agent extensions patch exactly the platform functions the integrity guard watches. What the default watch list contains, why pre-existing patching does not clear, and which failure action to choose.

Read article ›
Boundaries · New 2026-08-15 ~10 min read

Obfuscating htmx and Alpine apps: your logic is in the markup

An HTML attribute is not JavaScript, so the protector preserves it exactly and protects nothing in it. The renaming options that silently break an Alpine expression, and the exclusion list that prevents it.

Read article ›
Boundaries · New 2026-08-15 ~10 min read

Obfuscating ad tech JavaScript fights the channel that delivers it

A creative never runs on your hostname, so the domain lock fails before it reads the allowlist. Why the runtime guards misfire in a multi-party page, and what is genuinely worth protecting on the publisher side.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators