Build and Tooling

Protect the output of the build, not the input to it

Almost every build-time problem on this page has the same cause: protection ran at the wrong point, or ran twice with different naming decisions. Obfuscation reads finished JavaScript. Your bundler, your framework compiler and your codemods need ordinary code. Bundle, minify, then protect - and keep every file of one application in one project so the names agree across chunks.

Read the Failure Modes Try Online Obfuscator
Pipeline Order

One project, one pass

A file protected in a separate run gets its own naming decisions and will not agree with the rest of the application.

Bundle firstFramework compilers and tree-shaking need readable input.
Minify nextTerser and esbuild are a size optimisation, not a protection step.
Protect lastOne pass over the finished output, so every chunk shares one mapping.
Pipeline

Four decisions that prevent most build failures

None of these is about protection strength. They are about where the transform runs and what it can see.

Protect built output

Run protection after the bundler, on the artefacts you deploy. Protecting source and then bundling gives the bundler obfuscated input and usually a worse result.

One project per application

Cross-file renaming needs to see every file that shares a member name. Lazy chunks protected separately disagree with the entry bundle - see release workflows.

Keep the identifier map

Private, per build, so production stack traces can be read back. Symbolication is the reason to keep it and the reason not to publish it.

Fail the build, not the deploy

A protected build that is never executed in CI is an untested build. Run the application's own tests against the protected output - see command line builds and exit codes.

The Articles

Grouped by what reads the name

Each article names the party that writes each field, runs the correct build first, then compares the protected build against it. Where a result is reported, it was executed rather than inferred.

Where protection sits in the pipeline

Order, scope and the artefacts a build leaves behind. The source-map article is the one to read first if you ship maps to production.

Configuration that arrives as data

A config file, an environment variable and a remote flag payload are all written by something that never saw your rename. The keys in them are text; the keys in your code are names.

Node and server-side surfaces

Node reads its behaviour out of ordinary option objects, so this is the same ignored-key shape as the browser - with the file system, the network and your logs on the other side of it.

Data access and generated code

Column names, document keys and schema fields are supplied by a database or a specification, so your bundle does not own either end of them.

Frequently Asked

Common questions about this surface

Should I obfuscate before or after bundling?

After. Bundlers and framework compilers need ordinary JavaScript, and tree-shaking works on readable module structure. Protect the finished output, then deploy that.

Does obfuscation break code splitting?

Not when every chunk is protected in the same project and the same pass. It breaks when a lazily loaded chunk is protected separately, because that run makes its own naming decisions.

Does obfuscation replace minification?

No. Minification is a bandwidth optimisation and reverses with one click of a beautifier. Keep Terser or esbuild for size and add protection for risk.

Will protection break my ORM or database access?

Protection alone does not. Member renaming does, because a driver builds row objects from the column names in your SQL - those property names are written by the database, not by your bundle.

Can I obfuscate a monorepo package by package?

Only if no member name crosses a package boundary. Where packages share an interface, they have to be protected together or the shared names have to be reserved.

Do I have to publish source maps?

No, and you should not publish the ones that map back to original source. Keep them private for symbolication; a public map hands back everything protection removed.

Next

Start with the shapes, not the list

The build surface is one of four. The synthesis of what these failures look like is on the failure-modes page.

Six Failure Modes › Command Line Builds npm CLI Workflow Build Integration