Documentation

Scorecard

Reference guides for release workflows, command-line usage, cross-file protections, and the desktop app.

Build and Release Workflows Download Desktop App
Inside the Docs

Practical guides for real release work.

How-to guides Start with release sequencing and command-line usage, then move into feature-specific references.
Advanced protection Browse cross-file controls like Replace Globals and Protect Members when a build spans multiple scripts.

Scorecard

  • 2026-08-02
  • Procurement, security review, evaluation

A numbers-first summary of the JSO ecosystem and how it's tested. Where claims need verification, every entry links to the source of truth (npm package, CI template, doc page).

1
Published registry client
Node jso-protector 0.2.0 on npm. Eight other client implementations are tested in this repository but remain unreleased.
13
CI templates
GitHub, GitLab, Circle, Jenkins, Azure, Bitbucket, Drone, Buildkite, Woodpecker, Tekton, TeamCity, GoCD, Argo
8
Error-reporter integrations
Sentry, Bugsnag, Rollbar, Datadog, Honeybadger, Raygun, Airbrake, AppSignal
11
Build-tool plugin entrypoints
Vite, Webpack, Rspack, Rollup, esbuild, Next.js, Parcel, Metro/RN, Bun, Turbopack, Browserify/Gulp/Grunt
0
Published IDE plugin families
VS Code and JetBrains implementations exist in the repository but are not published to their marketplaces.
4
Kubernetes-native deployment patterns
Standalone Job · Helm chart (Job/CronJob) · Tekton · Argo
200
Executable engine samples
Normal and self-compressed output is externally parsed and, where applicable, executed with exact assertions; zero known defects in the current gate.
64 / 20
Real-library compatibility evidence
64 distributed libraries protect and parse; 20 popular libraries also match original runtime behavior in the maintained smoke matrix.

Client implementation and release matrix

LanguageMin runtimeHTTP transportRelease statusRepository verification
NodeNode 18fetchnpm 0.2.0Package test and release gates pass
PythonPython 3.8urllib (stdlib)UnreleasedPolyglot contract smoke passes
GoGo 1.21net/http (stdlib)UnreleasedPolyglot contract smoke passes where runtime is available
.NET.NET Standard 2.0HttpClientUnreleasedPolyglot contract smoke passes
RubyRuby 2.7net/http (stdlib)UnreleasedPolyglot contract smoke passes where runtime is available
PHPPHP 7.4ext-curl + stream fallbackUnreleasedPolyglot contract smoke passes where runtime is available
RustRust 1.70ureq (rustls)UnreleasedPolyglot contract smoke passes where runtime is available
JavaJDK 11java.net.httpUnreleasedPolyglot contract smoke passes where runtime is available
KotlinJDK 11java.net.httpUnreleasedPolyglot contract smoke passes where runtime is available

Security posture

  • Password hashing: new and changed passwords use PBKDF2-HMAC-SHA256 with 600,000 iterations, a 16-byte random salt, and a 32-byte hash. New passwords accept 12–128 characters, including spaces for passphrases. Successful sign-in transparently upgrades legacy plaintext and lower-work-factor PBKDF2 rows.
  • API-key passwords: MachineKey AES-CBC-encrypted at rest (auto-upgrades on first verify).
  • Admin password: PBKDF2 hash supported via JSOAdminPasswordHash; constant-time compare; cookie bound to UA+IP+XFF.
  • Account recovery: cryptographically random 256-bit recovery tokens are stored as HMAC-SHA256, expire after 30 minutes, are attempt-throttled, and are durably consumed once through an OS-level cross-worker transaction before the password changes. Password changes rotate the account authentication version through the same atomic metadata boundary so older login cookies are rejected.
  • ESLint plugin: catches base-64-shaped JSO API tokens hardcoded in source. Auto-fixes to process.env.
  • pre-commit hooks: jso-release-check + jso-dry-run + jso-credential-leak scan, all run before each git commit.
  • Polymorphism evidence: every API response includes BuildId and PolymorphismFingerprint; two consecutive obfuscations of identical input MUST produce different fingerprints.
  • Symbolication privacy: identifier maps stay on the customer machine; stack traces are demangled locally by jso-symbolicate. No third-party symbolication service.
  • Beacon webhook guidance: Runtime Defense beacons can be sent to the downloadable, customer-operated jso-beacon-slack collector for Slack, Discord, Splunk HEC, Elasticsearch, and signed-webhook routing. Customers own deployment, availability, credentials, retention, and response.

Verifiability

Every claim on this page links to a source you can inspect without contacting JSO:

Procurement use: this page is designed to fit in a vendor-evaluation spreadsheet. Each tile is a number that maps to a known category and a known source. If your evaluation rubric needs a number we don't show, contact support — recipes get added based on what real evaluations ask for.

Try this in the online obfuscator

Paste your own code and see this option applied, or compare plans for larger projects and the desktop app.

Try It Free See Pricing