Security Evidence

Proof paths for security, procurement, and release review.

Use this hub when a reviewer asks how JavaScript Obfuscator handles source, what evidence a protected release can produce, and where JSO fits beside larger security platforms.

Payment-Page Evidence View VM Proof Demo Source Handling Compare Gap Map
What This Proves

JSO is a focused JavaScript protection workflow with reviewable artifacts.

It does not replace a managed SOC, a SIEM, or full native mobile app shielding. It gives release teams practical proof around protected browser JavaScript plus hosted Web Integrity policy and hybrid-device signals.

Source-free packetsReviewer handoffs avoid original source, protected output, secrets, and customer data.
Customer-owned routingRuntime signals can feed dashboard triage and the monitoring tools teams already use.
Published boundariesPublic docs state where JSO is strong and where a specialized platform is the better fit.
Evidence Paths

Four ways to answer the hardest buyer questions.

Each path points to a concrete workflow, report, or dashboard view. The goal is quick diligence without pretending a focused obfuscation product is a full security operations suite.

Runtime

Monitoring and incident handoff

Token-authenticated runtime beacons land in Dashboard Monitoring for first triage, status actions, CSV/JSON export, and source-free evidence packets.

  • Tamper, debugger, and script-inventory events.
  • BuildID, severity, reason, URL, and fingerprint filters.
  • Customer-owned SIEM, Splunk, Elasticsearch, Slack, or signed webhook routing.
Runtime Docs Dashboard
Payment

PCI DSS payment-page evidence

Checkout owners can pair protected releases with script inventory, header snapshots, runtime incident exports, and PCI DSS v4 Markdown/JSON packets.

  • Approved versus observed payment-page scripts.
  • CSP, frame, HSTS, and header baseline snapshots.
  • QSA handoff boundaries that avoid card data and source.
Payment Guide Tooling Matrix
VM Proof

Sample proof for sensitive functions

The VM proof pack shows selected source shape, representative protected output, report fields, warnings, and performance guidance without exposing customer source.

  • Sample-only public demo, not arbitrary VM execution.
  • Corporate and Enterprise beta eligibility.
  • Reviewer checklist for pass/fail evidence.
Sample Demo Proof Pack
Source Handling

Hosted, npm, desktop, and local choices

Security reviewers can see what each workflow sends, which preflight commands stay local, how credentials are handled, and when the desktop app is the right path.

  • Hosted API and npm automation boundaries.
  • Desktop and hosted workflow boundaries for sensitive source handling.
  • Credential, source-map, manifest, and support guidance.
Processing Docs Desktop App
Competitor Gap Map

Use the right proof path for the right gap.

JSO closes direct browser-JavaScript protection gaps with workflow, evidence, and local-processing options. It stays explicit where a broader managed platform or native mobile vendor is the better fit.

Managed Webpage Integrity

Close with payment-page evidence, or pair with a specialist platform.

JSO produces source-free PCI-oriented artifacts: approved script inventory, header snapshots, runtime incident exports, and QSA handoff boundaries. It is not a managed Webpage Integrity operations console.

Payment-page guide
Runtime SOC

Use first-triage dashboarding and customer-owned routing.

Dashboard Monitoring helps teams filter, status, and export runtime events. Long-term retention, alert operations, and security response should live in the SIEM or monitoring system the customer already owns.

Runtime docs
VM-First Buying

Evaluate JSO through the fixed demo and proof pack.

VM-first competitors can be simpler when the entire purchase is public VM quota. JSO's current path is sample-only public proof, source-free report fields, pass/fail checks, and Corporate/Enterprise beta eligibility.

VM proof demo Proof pack
Native Mobile Shielding

Keep the category boundary clean.

JSO supports browser JavaScript and JavaScript-heavy hybrid workflows, including React Native device-integrity probes. Native Android/iOS binary obfuscation, anti-repackaging enforcement, and mobile fraud operations remain adjacent vendor territory.

Mobile boundary
Enterprise Procurement

Assemble a packet before the questionnaire arrives.

Use this hub with Security and Processing, Pricing, historical Clients context, support boundaries, release manifests, runtime exports, and payment-page evidence. Share evidence packets first, not source code.

Source handling Customer context
AI Resistance

Use current evidence now; treat the score as planned.

JSO does not claim protected JavaScript is AI-proof. Current AI-resistance review is source-free evidence and claim boundaries; the planned Resistance Score must remain separate until it is a live per-build artifact.

AI evidence
Best Fit

Use JSO when protected-output workflow matters.

JSO is strongest when a team wants online evaluation, desktop/local project work, published pricing, repeatable release automation, runtime first triage, and source-free evidence artifacts around browser-delivered JavaScript.

Compare Competitors Compare Plans
Boundary

Use a specialized platform when operations are the product.

Full SOC operations, SIEM retention, fraud platforms, and native mobile app shielding are separate buying categories. JSO supplies hosted Web Integrity policy, browser enforcement, incident evidence, and hybrid-device probes, but should not be sold as staffed monitoring or whole-binary shielding.

  • Browser and hybrid JavaScript protection: in scope.
  • Hybrid Android/iOS device signals: in scope; whole-binary shielding is adjacent.
  • Long-term incident operations and alert retention: customer monitoring system.
Reviewer Packet

A practical packet for a security review.

For a real evaluation, attach only source-free evidence and keep customer source, protected output, API credentials, collector tokens, payment data, and secrets out of tickets and external review tools.

1. Release proof

Signed manifest, watermark evidence, compatibility validation, and protected-build smoke results.

2. Runtime proof

Filtered Dashboard Monitoring JSON plus a runtime incident evidence packet when runtime events are in scope.

3. Payment proof

Approved script inventory, header snapshot, script drift audit, and PCI DSS v4 evidence report for checkout flows.

4. Advanced proof

VM proof pack output and the sample-only VM proof demo when selected sensitive functions need heavier review.