Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 193–204 of 256

Third-Party Risk · New 2026-08-14 ~9 min read

Obfuscation, tag managers and the scripts you do not control

The APIs analytics vendors wrap are almost exactly the APIs the anti-tamper guard watches, so your own marketing tags trip it. The default watch list in full, and what the script inventory detects.

Read article ›
API Security · New 2026-08-14 ~9 min read

Obfuscation will not hide your GraphQL API

The query documents your client sends are protocol, not code style, so they travel in plain text however the bundle looks. What protection genuinely covers, which server-side controls do the work, and the member-renaming rule that keeps response handling intact.

Read article ›
Build Strategy · New 2026-08-14 ~9 min read

Obfuscating a multi-tenant SaaS frontend: one build or one per tenant?

Per-tenant builds cost shared caching, a multiplied release matrix and per-build report retention, and buy distinguishability rather than protection. The three cases where they are genuinely right, and where tenant isolation actually lives.

Read article ›
Supply Chain · New 2026-08-14 ~9 min read

Does obfuscation break your SBOM?

A lockfile-derived bill of materials is untouched by protection. An artifact scanner is broken completely by it — and so is any vulnerability scan pointed at the shipped bundle. How to tell which kind you have, and where each step belongs.

Read article ›
Media · New 2026-08-14 ~10 min read

Can obfuscating your player stop video piracy?

Under Encrypted Media Extensions the key never reaches page script, so there is nothing in the player to hide. What streaming client code is genuinely worth protecting, and which controls actually move the number.

Read article ›
Workflow · New 2026-08-14 ~9 min read

Should you obfuscate during development?

No — and the Vite and Next.js integrations already default to skipping it. But a protected build nobody has run until release day is the other failure mode. The four-tier arrangement that fixes both.

Read article ›
Delivery · New 2026-08-14 ~10 min read

When your CDN rewrites your protected JavaScript

Protection is meant to be the last transformation — but CDN minifiers, script loaders and hosting plugins quietly add another one after the build. What breaks first, and the ten-minute digest check that names the culprit.

Read article ›
Realtime · New 2026-08-14 ~9 min read

Your WebSocket protocol is in your bundle

Realtime clients ship the protocol and the frames are readable in DevTools regardless of the build step. Why every message needs server-side authorization, what protection genuinely covers, and why WebSocket sits on the anti-tamper watch list.

Read article ›
Node.js · New 2026-08-14 ~8 min read

Compiling Node.js to a binary is not obfuscation

Single-executable builds embed your JavaScript as text and bytecode keeps the whole constant pool, so string literals and property names survive. What each tool removes, and the order to run packaging and protection.

Read article ›
Client-side data · New 2026-08-14 ~8 min read

Obfuscation does not protect what you store in the browser

Protecting the code changes nothing about the values it writes. Why localStorage, IndexedDB and the Cache API stay readable, why encrypting in client code moves the problem, and what belongs in browser storage.

Read article ›
Web security · New 2026-08-14 ~8 min read

Can someone put your protected app in an iframe?

Domain locking does not stop framing, because inside a frame your document still reports your own hostname. What frame-ancestors actually does, and the delivery contexts where an empty hostname fires the guard.

Read article ›
Authentication · New 2026-08-14 ~8 min read

Obfuscation, passkeys and WebAuthn

A passkey private key never enters your JavaScript, so obfuscating the ceremony protects no credential. What is actually worth protecting in an authentication bundle, and why password managers trip the tamper guard.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators