Can obfuscation stop candidates cheating on an online exam?
No, and no client-side control can. The exam runs inside a browser the candidate administers, on hardware they own, and every check you ship is JavaScript executing in their environment. Obfuscation raises the cost of reading and modifying your code, which is worth doing, but it does not make the browser trustworthy. The controls that actually decide an exam result are server-side: score on the server, deliver items one at a time, keep the answer key out of the bundle entirely, and treat every value the client reports as a claim rather than a fact.
What in an assessment bundle is actually worth protecting?
Four things, none of which is the answer key — that should never have been in the bundle. First, scoring and partial-credit rules, which are commercial logic that a competitor can lift verbatim. Second, item-selection and adaptive routing, including the difficulty parameters behind a computerised adaptive test, which represent years of psychometric work. Third, the client-side integrity heuristics themselves, because reading them tells a candidate exactly which behaviours are watched. Fourth, integration and licensing logic that reveals how your platform talks to an institution's systems.
Will the automation checks detect a candidate using Selenium or Puppeteer?
They will detect an unprepared one. The automation check looks for driver and headless markers — navigator.webdriver, PhantomJS and Selenium leftovers, and ChromeDriver-family cdc_ properties. That catches someone who downloaded a script and ran it. It does not catch a tuned headless browser, and the documentation is explicit that automation findings are capped at signal severity and never reported as high, because navigator.webdriver is a one-line patch. Route these findings to review queues and score-flagging workflows, never to an automatic fail.
Should an exam platform enable BlockDevToolsKeys?
Almost certainly not, and accessibility is the reason before security is. The option registers a global contextmenu handler that calls preventDefault on every right-click in the page, which removes copy, paste, spell-check, translation and the menu route keyboard users reach with Shift+F10. Assessment platforms usually carry contractual accessibility obligations to public institutions, and suppressing the context menu for every candidate is a poor trade against a control that only slows the incurious — the bytes are already downloaded by the time any key handler runs.
Will runtime defense interfere with accessibility tools candidates are entitled to use?
It can, and this is a real risk for assessment specifically. AntiMonkeyPatching watches event registration, timers, Fetch, XHR, Promise, storage and Web Crypto, and reports the first replacement it finds. Screen readers, magnifiers, text-to-speech extensions and accessibility overlays work by replacing exactly those APIs. A candidate using an approved accommodation can therefore trip a tamper signal through no fault of their own. Exclude the relevant dotted API paths with AntiMonkeyPatchingExcludeGlobals, choose a failure action that degrades rather than blanks the page, and test with real assistive technology before a live sitting.
How do per-institution builds and watermarks help an assessment vendor?
They convert a leak from an anonymous event into an attributable one. A watermark is an HMAC-SHA256 tag embedded in every protected file's header, verifiable later with the scan tooling, so a bundle recovered from a file-sharing site or a competitor's product identifies which institution's build it came from. Combined with a build seed, which makes protected output byte-identical for the same input and options, you can rebuild and prove exactly what a given tenant was served on a given date — useful when an academic-integrity dispute becomes a contractual one.
Is obfuscation a substitute for a lockdown browser or live proctoring?
No. A lockdown browser is a separate application with operating-system privileges that can restrict process launching, screen capture and display configuration. Obfuscation is a source-protection measure applied to the JavaScript in your web application, and it has no visibility outside the page. They solve different problems and the honest position is to say so: use obfuscation to protect your intellectual property and raise the cost of tampering with the client, and use invigilation, lockdown software or server-side item delivery to address exam integrity.
How do I debug a failed sitting when the code is obfuscated?
Keep the protection report for every release, tagged with the version each institution was served. Symbolication translates an obfuscated stack trace back to real names, but only against the report that produced that exact build, so if the report is lost the trace is unreadable permanently. In assessment this matters more than in ordinary software, because a candidate who reports a fault during a high-stakes sitting may be entitled to a remedy and you will need to establish what actually happened.