Research & Release Notes

AI-aware JavaScript protection, written down.

Long-form articles on what AI assistants can and cannot do with obfuscated JavaScript, how Maximum-mode transforms hold up against modern reverse engineering, and how teams put protection into release workflows.

Featured Article
Vendor Comparison 2026-04-26 ~10 min read

JavaScript VM protection compared — Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor by vendor on JavaScript bytecode VM protection. What Jscrambler, PreEmptive JSDefender, Verimatrix Code Protection, Digital.ai Application Protection, and the open-source virtualizers actually ship. Where JSO’s selective per-function virtualization fits. Includes a budget-band decision framework.

Read the full comparison

Browse by topic

Grouped hubs

Every article below tests one real library and reports what it measured. If you are looking for a surface rather than a date, start with the six failure modes — the synthesis of the whole series — or jump to the hub for the code you are shipping.

More research and roadmap

Newest first

Articles 73–84 of 256

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Plugin and Extension APIs?

A plugin API is a contract with code you did not build and cannot rebuild. Protection alone is clean on all five profiles. Member renaming makes a valid plugin fail its own load check, throws the error inside the vendor's code rather than yours, and in a two-build experiment made a host print a plugin's setup function where the plugin name belongs.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Background Jobs and Queues?

A job payload is written by one process and executed by another, often from a different release. Protection alone is clean on all five profiles. Member renaming made every job unroutable, removed the retry limit so an exhausted job ran again, and emptied the dead-letter log while jobs were still being parked.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break File System Options?

File system options do not carry data, they carry permission and limits. Protection alone is clean on all five profiles. Member renaming turned an exclusive-create guard into a silent overwrite, turned an append into a truncation, and made a copy exclusion stop excluding -- none of which raised an error.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break GraphQL Resolvers?

A resolver map is an object literal whose keys must equal the field names in your schema, and the schema is text that every shipped client already agrees with. Protection alone is clean on all five profiles. Member renaming made every field resolve to null while the response kept its shape, and made a conformance check report implemented fields as unimplemented.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Package Manifests and Module Resolution?

A build that writes a package manifest is writing a file node reads back with its own resolver. Protection alone is clean on all five profiles. Member renaming made node fail to resolve a generated entry point, dropped the version out of every crash report, and left a build that reads its own manifest reporting no dependencies at all.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Database Rows and ORM Models?

A database driver builds row objects from the column names in your SQL, so the property names on a row are not written by your bundle. Protection alone is clean on all five profiles measured against a real driver. Member renaming makes every column read undefined, turns order totals into NaN, drops columns out of the JSON you send onward, and makes the driver reject a named parameter it has never heard of.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break HTTP Request Handlers?

Request headers, query parameters and JSON bodies are written by the caller and by the runtime, not by your bundle. Protection alone is clean on all five profiles measured against a real server. Member renaming makes query values read undefined, drops fields out of the reply, throws at the first header access, and -- in the sharpest arm -- sends a request to a different host entirely.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Server-Sent Events and Log Streams?

Every record in a log feed or an event stream is written by the sender. Protection alone is clean on all five profiles measured. Member renaming turns an error stream into an empty one, collapses grouped totals into a single bucket named undefined, silences the alert that exists to page someone, and makes an event parser discard every frame before failing.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Health Checks and Metrics?

Memory figures, CPU times and resource usage come out of objects the runtime builds, so their property names belong to the platform. Protection alone is clean on all five profiles measured. Member renaming makes a health endpoint report degraded, a memory threshold alert that can never fire, and a container read that throws before the process finishes starting.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Multi-File Builds?

Protecting two files in separate runs does not just make them fail to find each other's property names. Measured here: each run restarts its own counter, so the same generated name means a different property in each file, and every value arrives intact and attached to the wrong name. Protecting the same code in one run was correct in every read.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Form Fields and FormData?

A form's field names are written by the browser from your HTML, and read by your server. Nothing in the bundle authors them. Protection alone is clean on all five profiles measured. Member renaming makes every field read as undefined, puts a generated identifier into the request body and into the message the user is shown, and turns a ticked checkbox into an unticked one.

Read article ›
Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break CSV and Spreadsheet Imports?

A CSV header row is written by whoever exported the file, and parsing it into row objects renames nothing. Protection alone is clean on all five profiles measured. Under member renaming the column reads return undefined, totals become NaN, and the record written back out does not contain a wrong value for the column -- it does not contain the column at all.

Read article ›

More articles coming

We publish on AI-aware protection, modern JavaScript build integration, runtime evidence, and how obfuscation fits with server-side authority. New posts are linked from the homepage when they go live.