Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 13–24 of 256

Authentication · New 2026-08-17 ~10 min read

Does obfuscation break passkey verification options?

Measured: renaming two option names let an assertion captured on a look-alike domain authenticate successfully - the one attack passkeys exist to prevent. Another let an attacker's own passkey confirm somebody else's account. Protection alone was clean on all five profiles.

Read article ›
Client-side storage · New 2026-08-17 ~10 min read

Does obfuscation break IndexedDB options?

Measured: one renamed pattern left a card number sitting in the browser profile in plain text while the application's own telemetry still reported the redactor as installed and running. Another let two accounts share one email address. Protection alone was clean on all five profiles.

Read article ›
Privacy and compliance · New 2026-08-17 ~10 min read

Does obfuscation break consent and tracking preferences?

Measured: renaming one flag turned a prohibition into a permission and the engine reported a category as permitted because a rule matched. Another profiled a fourteen-year-old who the site's own gate had refused. Protection alone was clean on all five profiles.

Read article ›
Search and data access · New 2026-08-17 ~10 min read

Does obfuscation break search query options?

Measured: a tenant filter and an authorization callback were each individually harmless, and losing both served one customer's documents to another. A separate arm returned a salary field to the browser. Protection alone was clean on all five profiles.

Read article ›
Media and DRM · New 2026-08-17 ~10 min read

Does obfuscation break DRM playback options?

Measured: renaming one option played a 4K title with no DRM at all on a device that fully supports it, while the player reported playback as normal. Two output-protection options each opened UHD to an unprotected output on their own. Protection alone was clean on all five profiles.

Read article ›
Scheduling and background work · New 2026-08-17 ~10 min read

Does obfuscation break scheduled job options?

Measured: renaming one option moved the nightly billing run four hours earlier, another let two copies of it run at once and bill every customer twice, and a third let a replica that should never have started run it at all. Protection alone was clean on all five profiles.

Read article ›
Offline and caching · New 2026-08-17 ~10 min read

Does obfuscation break service worker caching?

Measured: renaming one option handed a signed-in customer's account page, card digits included, to the next visitor with no session at all. Another kept a revoked administrator an administrator. Protection alone was clean on all five profiles.

Read article ›
Update and supply chain · New 2026-08-17 ~10 min read

Does obfuscation break software update checks?

Measured: renaming one boolean let a build nobody signed install itself, while the application still reported the strong signature verifier as installed - because it was, and was simply never called. Protection alone was clean on all five profiles.

Read article ›
Backup and recovery · New 2026-08-17 ~10 min read

Does obfuscation break backup and restore options?

Measured: renaming either half of a two-part guard wrote last night's archive in plain text, card numbers readable. Another arm put the release signing key into the backup, and a third silently cut ninety days of retention to seven. Protection alone was clean on all five profiles.

Read article ›
Notifications and delivery · New 2026-08-17 ~10 min read

Does obfuscation break push notification options?

Measured: renaming one option put a full card number and email address on a locked phone screen. Another delivered a ten-minute login code sixteen hours later, and a third turned one order notification into twelve. Protection alone was clean on all five profiles.

Read article ›
Transactions and consistency · New 2026-08-17 ~10 min read

Does obfuscation break transaction isolation options?

Measured: renaming one column name let two withdrawals of 60 succeed against a balance of 100 while the balance stayed at 100, and it switched off the conflict detection that was supposed to stop them. Protection alone was clean on all five profiles.

Read article ›
Encryption at rest · New 2026-08-17 ~10 min read

Does obfuscation break envelope encryption options?

Measured with real node crypto: renaming one option downgraded AES-GCM to AES-CBC, so an edited ciphertext decrypted to an attacker-chosen amount and the encryption context stopped being enforced at all. Protection alone was clean on all five profiles.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators