Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 25–36 of 256

Serving user files · New 2026-08-17 ~10 min read

Does obfuscation break file download headers?

Measured: two renamed options together served a user-uploaded HTML file as a page in the application's own origin, and a third let a filename write a Set-Cookie header of its own. Protection alone was clean on all five profiles.

Read article ›
Caching and disclosure · New 2026-08-17 ~10 min read

Does obfuscation break response cache directives?

Measured: renaming the response-cache options put a signed-in customer's page into a cache shared by every visitor, and the next anonymous request came back with their email, their card suffix and their session cookie. Protection alone was clean on all five profiles.

Read article ›
Payments · New 2026-08-17 ~10 min read

Does obfuscation break payment idempotency options?

Measured: renaming one option made a retried checkout charge the customer twice, and renaming another let the browser pay 99 cents for a 49.99 cart. Protection alone was clean on all five profiles.

Read article ›
Sessions and identity · New 2026-08-17 ~10 min read

Does obfuscation break session middleware options?

Measured: renaming one option on a session middleware left an attacker-planted session identifier signed in as the victim, and renaming another replaced 22 characters of application entropy with a counter. Protection alone was clean on all five profiles.

Read article ›
Configuration and merging · New 2026-08-17 ~10 min read

Does obfuscation break configuration merging?

Measured: renaming one option on a deep-merge helper let a tenant configuration document write to Object.prototype, and renaming the same name the detector uses turned the alarm off in the same edit. Protection alone was clean on all five profiles.

Read article ›
Outbound requests and SSRF · New 2026-08-17 ~10 min read

Does obfuscation break outbound request controls?

Measured: renaming one option on an HTTP client followed a user-supplied link into an internal service and returned a database password, and renaming a second put cloud metadata credentials in the response body. Protection alone was clean on all five profiles.

Read article ›
Caching and tenancy · New 2026-08-17 ~10 min read

Does obfuscation break cache key namespaces?

Measured: renaming one option on a cache client served one tenant's user record to another tenant, and renaming the profile's own field names left the secrets the application filters out sitting in the shared cache. Protection alone was clean on all five profiles.

Read article ›
Uploads and media · New 2026-08-17 ~10 min read

Does obfuscation break image processing limits?

Measured: renaming one option on an image pipeline decoded a 61 KB upload into six gigabytes of pixels, and renaming another published a photograph with its GPS coordinates intact. Protection alone was clean on all five profiles.

Read article ›
Cross-site request forgery · New 2026-08-17 ~10 min read

Does obfuscation break CSRF token verification?

Measured: renaming one option on a CSRF middleware made a token minted in an attacker's own session validate against a victim's, and renaming a second made the library accept a token out of the query string that the application had deliberately stopped reading. Protection alone was clean on all five profiles.

Read article ›
Authorization · New 2026-08-17 ~10 min read

Does obfuscation break permission rules?

Measured: renaming one key on a permission rule turned a prohibition into a permission, and renaming another dropped the row filter so a finance user could read every organisation's invoices. Both arms answered allowed=true with no error anywhere. Protection alone was clean on all five profiles.

Read article ›
Query safety · New 2026-08-17 ~10 min read

Does obfuscation break NoSQL query options?

Measured: renaming one query option let an operator object injected into a sign-in filter match users again, and renaming a second put the password hash and the MFA secret into the API response. A third arm failed closed on reads and open on writes in the same run. Protection alone was clean on all five profiles.

Read article ›
Realtime transport · New 2026-08-17 ~10 min read

Does obfuscation break WebSocket server options?

Measured: renaming one option on a WebSocket server removed the origin check entirely, so a page on an attacker's site completed a handshake with the victim's cookie attached. Renaming another took the per-message cap from 64 KB to 100 MiB. Protection alone was clean on all five profiles.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators