Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Open the Playground Maximum Mode Overview
Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

Six measured failure modes Language features Browser and DOM APIs Build and tooling Security controls

More research and roadmap

Newest first

Articles 37–48 of 256

Multi-factor authentication · New 2026-08-17 ~10 min read

Does obfuscation break one-time code verification?

Measured: renaming either half of an application-supplied replay cache made a one-time code that had already been used accepted a second time, with the verifier still reporting success. Renaming the window option widened acceptance from 30 seconds to 90. Protection alone was clean on all five profiles.

Read article ›
Parsing untrusted input · New 2026-08-17 ~10 min read

Does obfuscation break XML and YAML parser options?

Measured: renaming one option on a markup parser turned it into a file-read primitive that pulled /etc/passwd and the process environment off disk and into parsed output. Another took an entity bomb from 68 expansions to 11,111, and a third constructed a language-specific tag the safe schema exists to refuse.

Read article ›
Rendering user data · New 2026-08-17 ~10 min read

Does obfuscation break template escaping options?

Measured: renaming the autoescape option put a live script tag into rendered HTML. The more interesting arm renamed only the escaper: escaping still ran, the script tag was still neutralised, and an attacker still broke out of an HTML attribute - because the engine's own escaper does not touch quotes.

Read article ›
Outbound mail · New 2026-08-17 ~10 min read

Does obfuscation break mail transport options?

Measured: renaming two options on a mail transport attached the application's own .env file and a cloud metadata response to an outgoing email, so a live API key and a set of instance credentials left the host as attachments. A third sent SMTP credentials over the wire in plaintext.

Read article ›
Serving files · New 2026-08-17 ~10 min read

Does obfuscation break static file serving options?

Measured: renaming the root option on a static-file middleware served a private key from one level above the public directory. Renaming a different option returned 200 for the same URL with the app shell instead - identical status code, completely different meaning, and only one of them is a breach.

Read article ›
Observability · New 2026-08-17 ~10 min read

Does obfuscation break telemetry sampling options?

Measured: renaming the redaction list on a telemetry exporter sent a bearer token, a card number, a session cookie and a SQL statement containing a customer email address to a third-party endpoint verbatim. Nothing failed, nothing was logged, and every span still arrived.

Read article ›
Request handling · New 2026-08-16 ~10 min read

Does obfuscation break request body limits?

Measured: renaming the options on a body parser raises an 8 kB limit to the library's 100 kB default, lets 400 form parameters through, and - when the compression switch goes with it - accepts a gzip body that expands to fifteen times its declared size. Your own config dump keeps printing the old number.

Read article ›
Upload handling · New 2026-08-16 ~10 min read

Does obfuscation break file upload limits?

Measured: renaming the options on a multipart upload route turns every size and count cap into Infinity, admits a PHP file through a filter that used to reject it, and moves the whole upload from disk into memory - 41 MB buffered in RAM from one request, with nothing rejected and no error raised.

Read article ›
Authorization · New 2026-08-16 ~10 min read

Does obfuscation break OAuth client options?

Measured: renaming an OAuth client's option keys removes the CSRF binding on the callback, downgrades PKCE to the specification's plain default, admits a replayed id_token, and turns a one-scope request into a token carrying every scope the client is registered for. Every one of those requests is protocol-legal.

Read article ›
Object storage · New 2026-08-16 ~10 min read

Does obfuscation break presigned URL options?

Measured: renaming the options that scope a presigned object-storage URL stretches a one-minute link to fifteen minutes, removes the size and content-type conditions from an upload policy, and drops the key constraint so an uploader can write anywhere in the bucket - including over the object at its root.

Read article ›
Network identity · New 2026-08-16 ~10 min read

Does obfuscation break proxy trust settings?

Measured: renaming one option collapses every caller in the world onto your load balancer's address - which opened an admin allowlist scoped to the internal range to the entire internet. Renaming its neighbour does the opposite and honours a forged forwarded header from anyone.

Read article ›
Cross-site scripting · New 2026-08-16 ~10 min read

Does obfuscation break HTML sanitizer configuration?

Measured: member renaming can drop a sanitizer allowlist so the library falls back to its own defaults, re-admitting protocol-relative URLs, target attributes, plain http links and tags you had deliberately removed - with no error anywhere.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.

VM-Class Output Runtime Defense Guide Compare Obfuscators