Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 253–256 of 256

Runtime Boundaries · New 2026-08-15 ~10 min read

Should you obfuscate an edge function?

Code that never reaches a browser has a different adversary. Which runtime guards fail closed with no DOM, why the evaluation-based wrappers are skipped for module source, and the one case where the answer is yes.

Read article ›
What Ships With Your Code · New 2026-08-15 ~10 min read

Your pricing logic is in your bundle

Discount tiers and eligibility rules computed in the browser fail twice: they disclose how you price, and they let the customer choose the number. What protection helps with and what it cannot touch.

Read article ›
Build Pipeline Hygiene · New 2026-08-15 ~9 min read

Keeping open-source license notices in a protected build

Permissive licenses ask you to preserve attribution notices in what you distribute, and comment removal deletes them. Only the run of comments above the first statement survives, which decides the whole strategy.

Read article ›
Where Authority Lives · New 2026-08-15 ~9 min read

Your JavaScript cannot authenticate a payment

Strong customer authentication is a claim about who verified the payer, and a browser is not in a position to make it. Why dynamic linking belongs where the amount is authoritative, and where the checkout risk actually sits.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators