Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Server Timeouts and Limits?
An HTTP server's request timeout, headers timeout, keep-alive and header size cap are properties on one options object. Protection alone is clean on all five profiles. Member renaming served an oversized header block with a 200, let a slow-drip upload run past every deadline, and disabled the request timeout entirely through an option nobody thinks of as a security control.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break DNS and Socket Options?
Address family, resolver budgets and socket timeouts are properties on option objects the dns and net modules read. Protection alone is clean on all five profiles. Member renaming resolved an IPv4-only service to an IPv6 address, changed the shape of a lookup result from an array to a string, and left a socket waiting on a wedged upstream with no timeout at all.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Cookie Attributes?
HttpOnly, Secure, SameSite and Max-Age are read out of an options object by whatever writes your Set-Cookie header. Protection alone is clean on all five profiles. Member renaming dropped the flags from the emitted header, made a session cookie readable by script, turned logout into a no-op, and left the application's own security self-check reporting no findings.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Allowlists and URL Validation?
A validation library reads your policy out of an options object. Protection alone is clean on all five profiles. Member renaming did not make the checks fail; it reverted them to the library's defaults, so an off-host redirect target was accepted, a plain HTTP URL passed an https-only rule, a blocked mail domain was allowed, and a numeric bound stopped applying.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Your Web App Manifest?
A web app manifest generated in JavaScript is a document whose keys the browser fixes. Protection alone is clean on all five profiles. Member renaming published a valid JSON file that no longer describes an installable app: no launch URL, an untitled install prompt, no icons, an empty jump list, and a service worker update policy that reverted to the default.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Password Hashing Parameters?
Node reads cost parameters, key encodings and authentication tag lengths out of ordinary option objects. Protection alone is clean on all five profiles. Member renaming made every stored password stop verifying while the record beside the hash still claimed the strong cost parameter, and made an authenticated cipher accept a truncated tag.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Glob and Ignore Patterns?
Ignore patterns are strings and keep working. The switches that qualify them are properties on an options object. Protection alone is clean on all five profiles. Member renaming walked a capitalised test file into the published artifact while the packager's own leak audit still reported nothing.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Feature Flags and Remote Config?
A flag payload is written by a service you do not build with. Protection alone is clean on all five profiles. Member renaming turned a shipped feature off, turned a disabled feature back on, made a 25 percent rollout reach everybody, and left the operator report saying every flag was off while a disabled feature was running.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Named Capture Groups?
A regular expression survives protection byte for byte, so the group names inside it never move. The reads of those names do. Protection alone is clean on all five profiles; member renaming left the numbered groups and the replacement pattern working perfectly while every named read returned undefined, and turned a valid identifier into a rejected one.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break Property Descriptors?
The dictionary you hand Object.defineProperty is read by the JavaScript engine, which makes its keys an external contract. Protection alone is clean on all five profiles. Member renaming produced an object that serialises as empty with every value intact, an accessor that quietly became a value, and a read-only property that accepted a write into a second field.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break OpenAPI and Generated Clients?
An API description your build emits is an object literal whose key names are fixed by a specification and read by tools you do not ship. Protection alone is clean on all five profiles. Member renaming published a document with a generated key at the top level, produced an empty client from a valid-looking file, and named every generated method after a fallback string.
Read article ›
Compatibility · New
2026-08-16
~10 min read
Does Obfuscation Break AST Tools and Codemods?
A parser writes the node objects your tool reads, and your visitor object is read by the traversal library. Protection alone is clean on all five profiles. Member renaming produced a linter that reported a file clean, a codemod that reported zero changes, and a summary marked ok, all without visiting a single node.
Read article ›