AI-aware JavaScript protection, written down.

Measured Behaviour · New 2026-08-20 ~10 min read

Does obfuscation break catch quota accounting?

Measured: renaming the conversion deck left every landing recorded truthfully and every balance exact, drove a 24,574kg conversion uplift to zero, took a vessel from two refused landings to none, and produced numbers byte-identical to a control catch that was all landed whole.

Read article ›

Measured Behaviour · New 2026-08-20 ~10 min read

Does obfuscation break bycatch limits?

Measured: two renamed keys that each look like a bookkeeping detail took a fleet's charged bycatch from 2,010kg to 660kg, left three caps that should have closed the fishery wide open, and the programme's own check passed on every figure.

Read article ›

Measured Behaviour · New 2026-08-20 ~10 min read

Does obfuscation break closed area restrictions?

Measured: one renamed key took four real incursions to zero and moved a fleet's compliance rate from 75.00% to 100.00% - a line byte-identical to a control fleet that never went near a boundary. The projection fell from 52,500 incursions a year to none.

Read article ›

Measured Behaviour · New 2026-08-20 ~10 min read

Does obfuscation break minimum landing sizes?

Measured: renaming the string that names which datum a size limit is written in took five undersize lots to zero, 519kg of immature fish to none, and a season projection from 406,550kg to nothing - with every published limit still correct on screen and every fish measured to the millimetre.

Read article ›

Measured Behaviour · New 2026-08-20 ~10 min read

Does obfuscation break landing declaration checks?

Measured: one renamed key left the margin at ten per cent, the weights genuine and the weigh notes filed, and moved the comparison onto a trip total where a 970kg under-declaration and a 940kg over-declaration cancel to four kilograms. Two discrepancies became none.

Read article ›

Measured Behaviour · New 2026-08-19 ~10 min read

Does obfuscation break fare capping?

Measured: renaming the cap table charged a rider $85.35 for a week of travel the authority had capped at $63.50, breached the published ceiling by $17.35, drove the capped-fares and savings counters to zero, and the authority's own cap check passed - with every single fare correct to the cent.

Read article ›

Measured Behaviour · New 2026-08-19 ~10 min read

Does obfuscation break transfer windows?

Measured: renaming the transfer table turned seven journeys into fourteen, charged a commuter $35.70 for a day the tariff prices at $19.00, drove the continued-leg and savings counters to zero - and every single leg was still charged a fare the operator publishes.

Read article ›

Measured Behaviour · New 2026-08-19 ~10 min read

Does obfuscation break toll class determination?

Measured: renaming one classification key billed a car and caravan as a car and an articulated lorry as a rigid, dropping a gantry's take from $77.75 to $58.25 - about $16m a year on one lane - with the published rate deck complete, correct and every toll a real published rate.

Read article ›

Measured Behaviour · New 2026-08-19 ~10 min read

Does obfuscation break occupancy exemptions?

Measured: renaming one key stopped a managed lane comparing a driver's declared occupancy against the roadside count. A driver who claimed three occupants against a count of one went from paying $83.00 to travelling free, the false-declaration counter read zero, and the authority's own occupancy check passed.

Read article ›

Measured Behaviour · New 2026-08-19 ~10 min read

Does obfuscation break violation notice escalation?

Measured: losing the cure period cost drivers $55 and losing the penalty cap cost them $15, but losing BOTH billed $753.00 against a correct $318.00 - six times the sum of the halves - and a separate key billed $84.75 on a notice the statute had already voided, with the void counter reading zero.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break funds availability holds?

Measured: renaming the hold register released $9,200 of uncollected funds, left the ledger balance identical to the cent, drove the held-blocked and exposure counters to zero, and the bank's own availability check passed on figures that were all true - then two returned items left the account $2,750 overdrawn.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break garnishment and exempt funds?

Measured: renaming the protected-source list let one writ sweep $6,496 instead of $2,192 from an account funded by Social Security and veterans' compensation - with the balance exact, the arithmetic closing, the configuration screen still listing every protected source, and the exemption check passing.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break stop payment orders?

Measured: renaming the stop-order register paid every cheque a customer had told the bank not to pay, silently; renaming either qualifier on the same register dishonoured cheques nobody meant to stop, loudly - opposite directions from adjacent lines of one object.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break dormancy and escheatment?

Measured: renaming the owner-activity list made monthly interest postings count as the customer being there, so eight of eight accounts read active, $8,335 stopped being reportable to three states, and the sweep's own check passed on figures that were all true.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break ACH return windows?

Measured: renaming the deadline table made every stale return timely and accepted $9,240 the bank should have refused; renaming the banking calendar dishonoured $25,322 of good returns filed on their last banking day. Same file, adjacent lines, opposite directions.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break worker certification currency?

Measured: renaming the withdrawal register sent four workers whose tickets had been suspended or revoked onto the exact jobs those tickets cover, with the number examined unchanged, every other refusal identical, the withdrawal counter reading zero and the site's own competence check passing on true figures.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break permit to work authorization?

Measured: renaming the incompatible-pair table and the concurrency ceiling together issued thirteen of fourteen permits instead of nine, put a third ignition source into a flammable zone and doubled the fire watch, while each half alone moved the issued count by one and read like a rounding error.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break energy isolation verification?

Measured: renaming the machine energy-source table released every held job and reported zero of zero energy sources isolated and proved, with the plant's own isolation rule passing - and the same rule passed just as truthfully in the arm that stopped the plant dead.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break atmospheric testing limits?

Measured: renaming the unit declaration read a flammable-gas result of 0.75 percent by volume as 0.75 percent of the explosive limit - twenty times smaller - and permitted entry to a space at three times the gas limit, while losing the ceiling half of the oxygen band moved four times as many entries as losing the floor half.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break medical surveillance restrictions?

Measured: renaming the restriction list on a statement of fitness placed six workers into the exact role their doctor excluded them from, with placements unchanged, the restriction counter reading zero, and output byte-identical to a workforce in which nobody had a restriction at all.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break warranty coverage determination?

Measured: renaming the table that says which repairs fall under the powertrain term cut manufacturer-paid warranty from 13,047 to 6,152 dollars and billed customers for covered repairs, while renaming the transfer rule paid 3,762 dollars it should not have, with the same check passing in both.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break recall campaign applicability?

Measured: renaming one flag quietly reversed what a safety recall does about a vehicle it cannot identify. Vehicles examined stayed 30, undetermined stayed 4, every identifiable vehicle was classified identically, affected fell 14 to 10, and the completeness check passed.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break parts supersession rules?

Measured: renaming a supersession table put six superseded part numbers back on vehicles - including a control arm withdrawn because it cracked - while the check that exists to refuse superseded numbers passed, and the parts value moved by 153.20 dollars.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break labor time and claim pricing?

Measured: renaming the table of which labour operations are already included in others paid 16.60 extra hours on twenty claims - and the review line read better in the failing arm, reporting 27 of 27 operations paid where the correct run reports 20 of 27.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break goodwill authorization limits?

Measured: renaming the delegation-of-authority ladder cut customer assistance from 27,414 to 19,075 dollars; renaming the ladder and its fallback together removed every ceiling, and the only thing that stopped it was the annual budget, with the authority check passing in all three.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break indirect cost recovery?

Measured: renaming the list of categories excluded from an indirect cost base more than doubled the base and changed the invoice by nothing at all, because the award ceiling absorbed it. Renaming the ceiling as well billed 234,482.50 dollars more, with the negotiated rate printed correctly in every arm.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break cost allowability rules?

Measured: renaming a grant budget allowlist charged 21,680 dollars of unbudgeted consulting to a federal award and the policy check passed. Renaming the unallowable list alone moved no money at all. Renaming both was the only arm anything caught.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break effort certification?

Measured: renaming the field that records who signed an effort certification changed no charge, no cap and no total - 353,001.25 dollars identical to the cent - and left twenty certifications naming nobody. Three neighbouring fields on the same record stopped the run dead.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break cost sharing and match?

Measured: renaming the flag that bars federal money from a cost-share match counted 26,700 dollars of another agency's award toward this one and the commitment check passed. Renaming the countable-source list instead failed loudly - and the pair was identical to the loud half.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break subrecipient monitoring?

Measured: renaming a risk-tier table moved five subrecipients off annual on-site monitoring onto invoice review and the pass-through check passed. Renaming the monitoring plan alone was rejected outright - and renaming both was accepted, with fourteen subrecipients monitored by nobody.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break royalty rate tiers?

Measured: renaming the flag that says how a tiered royalty is applied moved 10,961.21 dollars on one statement, and renaming the tier boundaries moved 19,737.50 the other way. Gross sales were identical to the cent in every arm and the contract-ceiling check passed in every arm.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break advance recoupment?

Measured: renaming the list of recoupable cost categories moved 380,500.00 dollars of charges off an artist account and the business manager's own schedule check still passed. A second arm left the payment identical to the cent and nearly tripled the balance carried into every future period.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break statement period cut-off?

Measured: renaming the revenue recognition basis moved 159,960.00 dollars out of a year of royalty statements and pushed eight transactions past the reporting horizon entirely - while the recognised total stayed identical to the cent and the rightsholder's own reconciliation passed.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break licensing windows?

Measured: a licence window is a pair of bounds carried by two separate names, and the vendor default for each removes that wall. Renaming one cleared exploitation that predated the licence; renaming the other cleared exploitation that outlived it. Neither produced a single refusal to investigate.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break usage report matching?

Measured: renaming one policy name handed 50,820.00 dollars that was being held for eleven unidentified works to five rightsholders who do not own them - by a documented market-share formula, with the matched count, the unmatched count and the pool total all completely unchanged and the society's own rule passing.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break dividend entitlement?

Measured: renaming the settlement cycle moved 25,000 shares of a dividend from the fund that bought them to the fund that sold them. The total distributed was identical to the cent, the registrar's own reconciliation passed, and a second arm paid every holder nothing while still reporting that the distribution footed.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break margin call thresholds?

Measured: renaming a house margin requirement reverted it to the regulator's published minimum, cancelled a call on a real breach, and cut the stock actually sold from 35,376.00 to 3,080.00 - while a separate rename left every call on the report and quietly sold nothing at all.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break settlement date calculation?

Measured: renaming the market calendar put ten of forty deliveries due on days the exchange was shut - six of them on one holiday - while the check that exists to catch exactly that reported zero, because it consults the calendar that went missing.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break corporate action elections?

Measured: renaming one deadline recorded all forty-eight holders who wrote in on time as having said nothing, gave every share in the company the default election, paid 0.00 in cash against 2,556,521.10 - and the agent's tabulation still reported sixty holders, sixty elections and nothing outstanding.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break short sale locate rules?

Measured: two lists on one options object, both defaulting to the same empty array, failed in opposite directions. The allowlist refused twelve ordinary orders within a minute; the denylist silently stopped three regulatory close-out clocks and moved no other figure on the report.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break overbooking limits?

Measured: renaming the option that prices a walk widened an oversell authorisation from 8 rooms to 21, walked seventeen guests instead of four, and reported the cost of doing it as 0.00 while the property's own oversell rule passed. Protection alone was clean on all five profiles.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break fare rules and change penalties?

Measured: renaming the option that chooses between a change fee and the fare difference collected 4,816.00 instead of 13,486.00 while still charging a penalty on every ticket, and the waiver list moved the same money the other way. Protection alone was clean on all five profiles.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break loyalty tier qualification?

Measured: renaming the flag that joins two tier criteria with AND rather than OR promoted forty members on one criterion and took the programme's tier cost from 3,360.00 to 19,200.00, without changing a single published threshold. Protection alone was clean on all five profiles.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break length-of-stay restrictions?

Measured: renaming the option that applies a minimum-stay rule to every night of a stay rather than the arrival night filled eight protected holiday room-nights with short bookings and raised revenue by 4,624.00. Protection alone was clean on all five profiles.

Read article ›

Measured Behaviour · New 2026-08-18 ~10 min read

Does obfuscation break group blocks and cutoff dates?

Measured: renaming the cutoff option held 151 unclaimed group rooms to arrival, turned away 260 nights of transient demand and took the weekend from 132,976.00 to 92,508.00 -- with no contract breached and a settlement that foots. Protection alone was clean on all five profiles.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Frequency Capping?

Protection alone changed nothing in this test. Renaming the option that names WHO a frequency cap counts left every counter running and every limit intact, and took one household from 20 exposures over the flight to 58. A second arm breached the daily cap without moving a single dollar of spend.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Attribution Windows?

Protection alone changed nothing in this test. Renaming the option that names an attribution model left period one IDENTICAL to the cent, and then took the same budget from 1,473 conversions in period two to 717, from 1,656 to 502, and from 1,762 to 394. The error is not a constant. It compounds.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Budget Pacing?

Protection alone changed nothing in this test. Renaming the option that names a flight's pacing mode left the budget fully spent -- MORE fully spent than the correct run -- and bought 764,111 fewer impressions at a 16.76 effective CPM instead of 15.14, with the campaign dark for two days of the fortnight it was sold for.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Viewability Measurement?

Protection alone changed nothing in this test. Renaming the UNIT of a viewability dwell requirement -- one field away from the number itself -- turned one second into one millisecond, took the viewability rate from 37.50% to 50.00%, and over-billed the campaign by a third. The metric that would catch it improves.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Bid Floors and Deal Priority?

Protection alone changed nothing in this test. Renaming the competitive block list let the blocked advertiser win 300,000 impressions and took publisher revenue UP from 1,086.75 to 2,336.25 -- while BLOCKED-SERVED, the counter whose entire job is to report exactly that, stayed at zero.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Operating Expense Reconciliation?

Protection alone changed nothing in this test. Renaming the option that names the ORDER of a CAM reconciliation's four adjustments left all four running, each once, on the correct operands, over every expense line -- and moved one tenant's year-end bill from 5,943.07 to 21,294.53 while the reconciliation check printed the same sentence word for word.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Pro-Rata Share Allocation?

Protection alone changed nothing in this test. Renaming the option carrying a building's rentable area left the allocation engine with one number to divide by -- the sum of the suites it could see -- so the shares summed to exactly 100% instead of 82.2%, the owner's 283,754.92 of vacancy cost moved onto the paying tenants, and every check passed.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Percentage Rent Breakpoints?

Protection alone changed nothing in this test. Renaming the negotiated breakpoint did not produce a missing threshold -- it produced the natural breakpoint, a real figure from every leasing textbook -- and the tenant's overage rent went from 71,040.00 to 109,860.00 with the settlement check printing the same sentence word for word.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Rent Escalation Clauses?

Protection alone changed nothing in this test. Renaming the flag that makes an index-linked escalation compound cost 50,381.06 over a five-year term -- and renaming the annual ceiling as well put the total back exactly, because the two escalation modes are algebraically identical until a collar clamps one of them.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Co-Tenancy and Rent Abatement?

Protection alone changed nothing in this test. Renaming either half of a co-tenancy condition was byte-identical to the correct run on every figure that matters -- and renaming both halves in one pattern took 248 failing days to zero, erased 40,906.85 of the tenant's rent abatement, and passed the abatement check.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Number Portability Routing?

Protection alone changed nothing in this test. Renaming the ported-number table sent three subscribers' calls to the carrier that no longer serves them -- with no error, no refusal and no dropped call -- and renaming the port-out PIN on both sides of its own comparison approved a request that quoted the wrong PIN.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Interconnect Rate Decks?

Protection alone changed nothing in this test. Renaming one published dial prefix left every call matched against a real rate, the coverage check reading twelve of twelve, and the run's margin at minus 3.75 on twelve calls that should have earned plus 0.56.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Roaming and Fair-Use Limits?

Protection alone changed nothing in this test. Renaming the one key that says what the usage figures mean took a metering run from 802.38 charged and four subscribers throttled to 0.74 charged and none -- with every session still priced in a published zone and the coverage check still passing eight of eight.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Emergency Call Routing?

Protection alone changed nothing in this test. Renaming the list that says which location fix to believe sent two of six emergency calls to the wrong dispatch jurisdiction -- with every call answered, every call inside a published area, and the authority's own route check passing six of six.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Service-Level Credits?

Protection alone changed nothing in this test. Renaming the excluded-cause list paid 10,827.50 in credits against a correct 1,895; renaming the credit tiers on the same object paid nothing at all. Both arms reconciled against the calendar to the minute.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break HACCP Critical Limits?

Protection alone changed nothing in this test. Renaming the critical-limits table left all nine monitoring readings taken, logged and counted -- and checked against nothing, so a shift with an undercooked lot and a warm chiller reported zero deviations and held no product.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Pesticide Residue Screening?

Protection alone changed nothing in this test. Renaming the option that says which unit the laboratory reported in divided every decision value by a thousand: two genuine exceedances became zero, all eight samples were still compared against a published limit, and the buyer's own coverage check passed.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Supplier Approval Records?

Protection alone changed nothing in this test. Renaming the name-matching option left every record genuine, every non-conformance counted exactly once and the ledger footing to the record -- and moved only how many suppliers those records represent, so the site carrying four major non-conformances was approved to ship.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Allergen Labeling Controls?

Protection alone changed nothing in this test. Renaming the regulated-allergen list alone was caught cold by the plant's own label rule; renaming it together with the flag that enables that rule shipped a pack containing milk, egg, gluten and soya under a label reading CONTAINS nothing.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Grain Grading and Deductions?

Protection alone changed nothing in this test. Renaming the minimum test weight inside the grade table sent every load to the bottom grade and took 4,319.66 off four settlements -- with all four loads reported as graded, every weight exactly right, and the ticket footing to the kilogram.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Randomization and Allocation?

Protection alone changed nothing in this test. Renaming the block-size option left every subject assigned exactly once, the arms exactly balanced and the protocol's own allocation check reporting a BETTER number than it reports on the correct list -- while the share of the sequence derivable from the part already issued went from 16.7% to 50.0%.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Trial Eligibility Screening?

Protection alone changed nothing in this test. Renaming one field named by an exclusion criterion enrolled a subject with a 38% ejection fraction into a cardiotoxic study -- with all eight criteria reported as evaluated, the coverage count correct, and the protocol's own completeness check passing.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Adverse Event Reporting Clocks?

Protection alone changed nothing in this test. Three separate renames each produced a safety database in which no expedited report was ever late -- including one where a death reported nine days after sponsor awareness, on a seven-day track, came back as filed in time.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Drug Accountability?

Protection alone changed nothing in this test. Renaming the field carrying returned units put every subject at 100.0% treatment compliance, moved a subject who took 59.5% of their drug back into the per-protocol population, and left the accountability ledger footing to the unit.

Read article ›

Measured, not asserted · New 2026-08-18 ~10 min read

Does Obfuscation Break Visit Windows and Deviations?

Protection alone changed nothing in this test. Renaming either of the two options carrying the protocol's visit windows was byte-identical to correct. Renaming both erased the entire deviation log -- fifteen visits in window, zero reportable, on a trial with three deviations and one of them major.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Progress Billing and Retainage?

Protection alone changed nothing in this test. Renaming the retainage percentage on its own changed nothing either -- and renaming it together with the percentage at which it steps down released the entire $80,250.00 the owner was holding, on a payment application that still footed to the cent.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Change Order Pricing?

Protection alone changed nothing in this test. The contract's markup ceiling caught every route to over-pricing a change order package and was blind to every route to under-pricing it -- and a purpose-built experiment showed the ceiling itself disappears once the contract maximum arrives from the contract instead of from the source file.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Lien Waiver Tracking?

Protection alone changed nothing in this test. Renaming the field that links a contractor to its lower tiers released $344,750.00 against zero examined claimants -- with the owner's own completeness rule passing and reporting, truthfully, that no tier had been left open.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Prevailing Wage Payroll?

Protection alone changed nothing in this test. Renaming the date on a wage determination selected a superseded but entirely genuine published schedule, and a certified payroll owing $201.60 of back wages reported itself in compliance -- with the contractor's own payroll check passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Contract Time and Liquidated Damages?

Protection alone changed nothing in this test. Renaming the field that dates a delay event left every delay genuine, every classification correct and every event counted exactly once -- and granted 51 days of extension where 42 were owed, cutting $83,200.00 of liquidated damages to $54,400.00 with the contract's own review rule passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Vesting Schedule Calculation?

Protection alone changed nothing in this test. Renaming the option that decides whether a plan year counts at all moved a terminating participant from 40% vested to 60% -- $2,480 of employer match that should have been forfeited back to the plan, paid out instead, with every dollar figure plausible and the plan's own service check passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Required Minimum Distributions?

Protection alone changed nothing in this test. Renaming the field that dates a published life-expectancy table selected the superseded 2002 divisors instead of the 2022 ones, and a retiree who had taken the correct distribution was reported as $1,241.27 short with $310.32 of excise tax -- with the plan's own divisor check passing and naming the wrong table as its evidence.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Contribution Limit Enforcement?

Protection alone changed nothing in this test. Two caps on one options object failed in opposite directions: losing the catch-up age invented a $6,900.00 excess for a 57-year-old who was inside the limit, and losing the annual limit together with the check in front of it made a real $1,800.00 excess deferral disappear. The widest rename pattern hid both.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Nondiscrimination Testing?

Protection alone changed nothing in this test. Two independent routes into the highly compensated group sit on one object in one file: renaming either one left the test result completely unchanged, and renaming both -- plus the check written to catch exactly that -- emptied one side of the comparison and certified a failing plan as passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break QDRO Account Division?

Protection alone changed nothing in this test. Renaming the division basis together with the flag in front of the order's own weighting rule awarded an alternate payee $501,552.00 out of a $486,000.00 account and left the participant with negative $15,552.00 -- and the reconciliation the plan relies on reported true, because a division that adds back up is an invariant of the code rather than evidence about the result.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Emissions Rolling Average Limits?

Protection alone changed nothing in this test. Renaming the option that names the averaging period, together with the check that would have caught it, turned a 30-day average of 0.1515 lb/MMBtu over a 0.150 limit into a one-day average of 0.1180 reading IN COMPLIANCE -- with 100% data availability and every hourly reading in the window genuine.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Air Permit Threshold Tracking?

Protection alone changed nothing in this test. Renaming the field that tells a rollup its data has moved served a total that was correct four months earlier: 82.4 tons against a 95-ton permit cap, when the corrected figure was 103.6 and over the major-source threshold. The answer was not wrong -- it had expired.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Hazardous Waste Manifest Tracking?

Protection alone changed nothing in this test. Renaming the thresholds that derive a generator's regulatory category left the quantity perfectly readable at 1,850 kg a month and classified the site as the smallest category -- so a 90-day storage limit became 270 days, a site holding waste 118 days read IN COMPLIANCE, and the site's own guard certified it.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Discharge Permit Monitoring?

Protection alone changed nothing in this test. Renaming both limits on one permit produced a monitoring report printing a 12.80 mg/L maximum and a 6.49 mg/L average and certifying NO VIOLATIONS -- every one of the eight results genuine, the sample count correct, and the plant's own frequency check passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Spill Reporting Thresholds?

Protection alone changed nothing in this test. Renaming the substance lookup key made every release reportable, which is loud; renaming the fail-safe default beside it made 8,740 pounds including 8,000 pounds of methanol read NOTHING REPORTABLE, with the site's own identity check passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Laytime and Demurrage Calculation?

Protection alone changed nothing in this test. Renaming the word that decides which recorded hours count as laytime moved one port call from $1,500 to $18,000 and another from $7,500 to $4,500 -- opposite directions from one rename, with every hour on the statement of facts still correct and the owner's own reconciliation still passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Container Weight Verification?

Protection alone changed nothing in this test. Renaming the flag in front of the SOLAS gross-mass condition, together with the condition itself, loaded a container that had no verified gross mass at all -- and both weight limits passed it, because every comparison against an unreadable number is false.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Dangerous Goods Segregation?

Protection alone changed nothing in this test. Renaming the class field left every package individually correct and moved only the requirement BETWEEN two of them: a flammable liquid and an oxidiser six metres apart, where twelve are required, read MAY SAIL with the same unit count, the same pair count and the same completeness check passing.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Vessel Loading and Draft Limits?

Protection alone changed nothing in this test. A sailing draft of 12.40 metres cleared a 12.00 metre port because the loading computer read it as feet -- and the two operands of a single tank-top ratio failed in opposite directions, one refusing everything and the other clearing an overloaded hold.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Cargo Release Against Bills of Lading?

Protection alone changed nothing in this test. This is the one area measured where every vendor default is permissive -- including one that is permissive by being TRUE -- so cargo was released on one original of three, released to a stranger, and released against a letter of indemnity the carrier had deliberately switched off.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Court Deadline Calculation?

Protection alone changed nothing in this test. Renaming ONE row of a limitation table sent a one-year claim to a six-year fallback and diarised it five years late, with the claim type, the filing date and the court calendar all still correct. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Conflict of Interest Screening?

Protection alone changed nothing. Renaming the alias table let a firm open two matters adverse to its own client while the conflicts search reported the number of parties it had searched, correctly, and found nothing. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Privilege Review and Production?

Protection alone changed nothing. Renaming the tag field moved three privileged documents from the withheld side of a production to the produced side, and the completeness check -- every document accounted for -- stayed true, because moving an item between two halves does not change the total.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Client Trust Accounting?

Protection alone changed nothing. Renaming the matter identifier merged two clients into one ledger, so a disbursement funded by another client's money committed with an empty breach list and a three-way reconciliation that balanced exactly.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Evidence Chain of Custody?

Protection alone changed nothing. Two unreadable custodian names compare equal, so a broken chain of custody read as continuous and an exhibit that should have been excluded was admissible with no reason listed at all. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Weight and Balance Calculations?

Protection alone changed nothing in this test. Renaming ONE station key released an aeroplane whose centre of gravity sat behind the aft limit, with the gross weight exactly right and the station still visible in the configuration dump. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Flight Duty and Rest Limits?

Protection alone changed nothing. Renaming the segment count rostered a crew 0.9 hours past its duty limit against a fallback of 16 hours -- a real number, printed, and blessed by a guard that only checks the limit is finite. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Maintenance Interval Tracking?

Protection alone changed nothing. Losing one of three whichever-comes-first criteria left every remaining comparison perfect and reported an overdue inspection as in limits -- caught six times out of six by one assertion, and defeated by the flag in front of it. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Minimum Equipment List Dispatch?

Protection alone changed nothing. Renaming one policy key let an aeroplane dispatch with equipment that is not on the minimum equipment list at all -- and the operator's own deferral check never ran, because it sits after the branch that made the decision. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Alert Delivery and Acknowledgement?

Every failure this series has measured ends in a wrong answer. This one does not. Renaming the distribution list delivered an operational limitation to nobody while both caller-supplied guards passed and the flight dispatched. Measured on both targets, with a purpose-built control.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Degree Audit Requirements?

Protection alone changed nothing in this test. Renaming one option conferred a degree with two requirements filled by the same three courses -- every requirement reading SATISFIED and the credit total reconciling. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break GPA and Grade Calculation?

Protection alone changed nothing in this test. Renaming the repeat policy moved a published GPA from 3.48 to 2.66 with the quality-points total unchanged and the validation rule passing. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Prerequisite Enforcement?

Protection alone changed nothing in this test. Renaming the field holding the prerequisite links enrolled a student with an empty unmet list, while the completeness check reported the walk complete. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Transfer Credit Equivalency?

Protection alone changed nothing in this test. Renaming the option naming the sending calendar awarded one applicant fifteen credits they never earned, while a cap hid the same error entirely on another. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Academic Standing and Probation?

Protection alone changed nothing in this test. Renaming two threshold options put every student in good standing with financial aid eligible, including one due for dismissal. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Spec Limits and Guard Bands?

Protection alone changed nothing in this test. Renaming the option that carries the guard band shipped two parts that the guard band existed to stop -- with the measurement, the accept window and the drawing limits all printed correctly. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Batch Genealogy and Recall Scope?

Protection alone changed nothing in this test. Renaming the field that links a lot to what consumed it produced a recall covering one lot instead of six and zero units instead of 1,500 -- and the completeness check reported the walk complete. Measured.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Calibration and Gauge Controls?

Protection alone changed nothing in this test. One rename pattern reached two independent gauge controls and accepted a reading taken on an instrument 800 days past calibration -- while the caller's certificate check reported it verified. Measured.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Control Chart Rules?

Protection alone changed nothing in this test. Three names in one rename pattern turned a control chart that was signalling a real process shift into one reporting the process in control, with every plotted value correct. Measured on both targets.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Batch Release Sign-offs?

Protection alone changed nothing in this test. Renaming the option that lists the required signing roles released a batch with the attribution reading 'nobody' -- while the segregation-of-duties control still reported itself required. Measured.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Interest Accrual and Day Count?

Protection alone did not change a single posting in this test. Renaming the option key that says what a year means moved a loan's annual interest by $210.97 -- and the servicer's own reconciliation, printed on the same line, passed it, because a 1.39% error is smaller than any tolerance a reconciliation can enforce.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Rate Index Effective Dates?

A tenth failure shape, and the first one a plausibility check cannot see. Renaming the field that dates a published rate series sent two adjustable-rate mortgages to 2.875% and 4.750% instead of 6.875% and 7.375% -- every value genuine, every cap reported, and the range check that was supposed to catch it passed by construction.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Payment Waterfall Allocation?

The same payment, the same total, the same books -- and a borrower who paid their statement reported past due with $465 sitting in suspense. One arm was sharper still: every dollar was allocated exactly correctly and the loan was reported delinquent anyway.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Escrow Analysis and Cushion?

This is the pass where the previous pass's own recommended mitigation was put on the bench. A provenance assertion caught the fault outright -- and then the enabling flag in front of it was renamed by the same pattern, and the escrow payment came out $105.84 a month short with the evidence printed on the same line.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Delinquency and Late Fees?

One grace period decides two outcomes, and only one of them was guarded. The servicer's rule refused every improper fee exactly as written -- and the same lost name reported a borrower who paid two days after the due date to a credit bureau, with nothing standing in the way.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Meter Reading and Consumption?

Protection alone does not change what a meter read bills. Renaming the members the billing engine reads does, and this article shows the measured result: a $117.76 bill that became $18,149.76 once the plausibility check that had been catching the error was switched off by a second renamed name.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Time-of-Use Tariff Windows?

Protection alone does not change what a tariff charges. Renaming the members it reads does, and this article shows the measured result: every kilowatt-hour billed exactly once, the metered total identical to the tenth, and two customers on the same tariff moved in opposite directions.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Demand Charge Calculation?

Protection alone does not change a demand charge. Renaming the members it reads does, and this article shows the measured result: an averaging window that added $1,609.50 to one site's bill, a ratchet that removed $4,634.25 from another's, and a peak of zero kilowatts that passed a finite check.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Net Metering Credits?

Protection alone does not change a solar customer's bill. Renaming the members the settlement engine reads does, and this article shows the measured result: the same 1,260 kilowatt-hours across the meter, and a bill that moved from $33.12 to $231.84 because the engine stopped knowing which way the energy went.

Read article ›

Measured, not asserted · New 2026-08-17 ~10 min read

Does Obfuscation Break Energy Cost Allocation?

Protection alone does not change how a shared bill is divided. Renaming the members the allocation engine reads does, and this article shows the measured result: the allocated total still equal to the billed total to the cent, the configuration screen still correct, and $4,843.75 moved from one tenant to three others.

Read article ›

Claims and benefits · New 2026-08-17 ~10 min read

Does Obfuscation Break Insurance Claim Adjudication?

Protection alone does not change what a claim adjudicator decides. Renaming the members it reads does, and this article shows the measured result: a family plan that silently became five individual plans, and a household billed $11,800 against the $6,000 out-of-pocket maximum it bought.

Read article ›

Claims and benefits · New 2026-08-17 ~10 min read

Does Obfuscation Break Policy Coverage Limits?

Protection alone does not change what a policy pays. Renaming the members it reads does, and this article shows the measured result: an excluded flood loss paid at $25,000, a sublimit still visible in the configuration while the claim it governs is paid in full, and a refusal whose stated reason says the policy is in force.

Read article ›

Claims and benefits · New 2026-08-17 ~10 min read

Does Obfuscation Break Coordination of Benefits?

Protection alone does not change which of a member's two plans pays first. Renaming the members it reads does, and this article shows the measured result: no payer dropped, no benefit changed, no number unreadable - only the order moved, and the member was billed $600 more.

Read article ›

Claims and benefits · New 2026-08-17 ~10 min read

Does Obfuscation Break Prior Authorization Rules?

Protection alone does not change which services need an authorization. Renaming the members it reads does, and this article shows the measured result: a revoked authorization accepted, a stale one honoured, and a refusal whose stated reason is that the request was approved.

Read article ›

Claims and benefits · New 2026-08-17 ~10 min read

Does Obfuscation Break Underwriting and Rating Rules?

Protection alone does not change what a risk is quoted. Renaming the members it reads does, and this article shows the measured result: a wildfire-exposed property quoted at a third of its premium, a declined class bound anyway, and a rating factor still visible in the configuration under a new name.

Read article ›

Clinical safety · New 2026-08-17 ~10 min read

Does Obfuscation Break Drug Interaction Checks?

Protection alone does not change what a prescribing-safety screen decides. Renaming the members it reads does, and this article shows the measured result: two allergy layers that each looked cosmetic when broken alone, and a patient with documented anaphylaxis handed a penicillin.

Read article ›

Clinical safety · New 2026-08-17 ~10 min read

Does Obfuscation Break Dosage Calculation Rules?

Protection alone does not change a weight-based dose. Renaming the option key that says what unit the weight is in does, and the measured result was a four-year-old prescribed 33 mg where the chart intended 15 mg, with every guard reporting normal.

Read article ›

Clinical safety · New 2026-08-17 ~10 min read

Does Obfuscation Break Lab Reference Ranges?

Protection alone does not change how a lab result is flagged. Renaming the unit field on the result row does, and the measured outcome went both ways in one file: a normal glucose held as a critical panic value, and acute kidney injury released as mildly low.

Read article ›

Clinical safety · New 2026-08-17 ~10 min read

Does Obfuscation Break Patient Record Access Rules?

Protection alone does not change who can open a chart. Renaming the members it reads does, and the measured results included a sealed record opening without consent and three withheld fields leaving on a billing screen under new names.

Read article ›

Clinical safety · New 2026-08-17 ~10 min read

Does Obfuscation Break Clinical Alarm Thresholds?

Protection alone does not change when a patient monitor alarms. Renaming the members it reads does, and the measured result was every alarm in the file going silent while the dashboard reported each patient as within limits.

Read article ›

Rates And Surcharges · New 2026-08-17 ~10 min read

Does obfuscation break shipping rate rules?

Measured: renaming the negotiated dimensional divisor billed a six-pound box as eighty-seven pounds, renaming the surcharge ceiling let a 25.5 percent stack through, and renaming the customer agreement quietly reverted every quote to list price. One half of a paired option was inert, which made the pair look safer than it was. Protection alone was clean on all five profiles.

Read article ›

Dangerous Goods · New 2026-08-17 ~10 min read

Does obfuscation break hazmat shipping restrictions?

Measured: a carrier refused fireworks two different ways on purpose, each rule renamed alone still refused them and only changed the reason, and renaming both put class 1.4 explosives on a road truck and a lithium battery on a plane. The same allowlist failed closed one way and open the other. Protection alone was clean on all five profiles.

Read article ›

Trade Compliance · New 2026-08-17 ~10 min read

Does obfuscation break denied party screening?

Measured: renaming the fuzzy-match threshold let a near-name-match to a listed party ship while the exact match was still caught, so a spot-check passes. Two thresholds phrased opposite ways both failed open, for a reason that had nothing to do with how they were phrased. Protection alone was clean on all five profiles.

Read article ›

Customs And Duty · New 2026-08-17 ~10 min read

Does obfuscation break customs duty calculation?

Measured: two duty ceilings one line apart failed in opposite directions, a lost tariff table moved three shipments three different ways, and renaming the origin-certificate pair honoured a certificate issued to somebody else. A record field became NaN where an option key quietly took the vendor default. Protection alone was clean on all five profiles.

Read article ›

Cold Chain · New 2026-08-17 ~10 min read

Does obfuscation break cold chain delivery rules?

Measured: renaming one half of a temperature band signed for a vaccine that spent three hours below freezing while the other half kept reporting correctly, and the quietest arm printed a two-hundred-minute excursion in the line that accepted the shipment. Two fields looked safe until the delivery record arrived as JSON instead of code. Protection alone was clean on all five profiles.

Read article ›

Payroll And Wages · New 2026-08-17 ~10 min read

Does obfuscation break payroll calculation rules?

Measured: renaming the overtime threshold removed the premium and said so, renaming the multiplier paid the same reduced amount while still printing twelve overtime hours on the payslip, and renaming the sanity cap paid 22,500 dollars for a mistyped timecard. Protection alone was clean on all five profiles.

Read article ›

Scheduling And Rostering · New 2026-08-17 ~10 min read

Does obfuscation break shift scheduling rules?

Measured: a rota protected an ICU post twice on purpose, each control renamed alone still refused an uncertified nurse and only moved the reason, and renaming both together rostered them onto the night shift. Protection alone was clean on all five profiles.

Read article ›

Leave And Accrual · New 2026-08-17 ~10 min read

Does obfuscation break leave accrual policies?

Measured: renaming a leave balance granted two hundred hours against a balance of eight, because the check asks whether the request is too large and a comparison against undefined is false. The same pass measured a threshold that failed the opposite way. Protection alone was clean on all five profiles.

Read article ›

Approvals And Controls · New 2026-08-17 ~10 min read

Does obfuscation break timesheet approval controls?

Measured: the same timesheet, with the same values and the same rule, was refused when it arrived as stored JSON and approved by its own author when the application had rebuilt it in memory first. Three separate controls fell to one renaming pattern. Protection alone was clean on all five profiles.

Read article ›

Benefits And Eligibility · New 2026-08-17 ~10 min read

Does obfuscation break benefits eligibility rules?

Measured: an attestation check sat behind an enabling flag, and losing either name enrolled a forged attestation while the configuration still reported a caller-supplied verifier. Two fields on adjacent lines of one object broke different records. Protection alone was clean on all five profiles.

Read article ›

Discounts And Coupons · New 2026-08-17 ~10 min read

Does obfuscation break discount and coupon rules?

Measured: renaming the flag that stops a coupon stacking changed nothing a shopper could see, renaming the cart-wide discount ceiling cost 40 dollars, and renaming both together took a 500 dollar cart to 130. Protection alone was clean on all five profiles.

Read article ›

Inventory And Oversell · New 2026-08-17 ~10 min read

Does obfuscation break inventory reservations?

Measured: renaming the field holding a stock count did not make it zero, it made it NaN, and every refusal test against NaN is false, so the warehouse promised forty units it did not have. Protection alone was clean on all five profiles.

Read article ›

Tax And VAT · New 2026-08-17 ~10 min read

Does obfuscation break tax calculation rules?

Measured: renaming one flag on a jurisdiction rule charged 186.99 of VAT that was not owed, and the amount the customer paid did not change by a cent, so nothing on the invoice looked wrong. Protection alone was clean on all five profiles.

Read article ›

Entitlement And Licensing · New 2026-08-17 ~10 min read

Does obfuscation break plan entitlement checks?

Measured: two fields written by the same line of code failed in opposite directions, because one was read by our own function and one by an installed library. A forged licence was accepted, and a genuine one read from a file was refused.

Read article ›

Gift Cards And Store Credit · New 2026-08-17 ~10 min read

Does obfuscation break gift card redemption?

Measured: a card holding 500 dollars paid out 900, because a balance that cannot be read is not zero. And a stolen card was redeemed in full while the fraud check that refused it ran correctly and reported its refusal.

Read article ›

Account Recovery · New 2026-08-17 ~10 min read

Does obfuscation break account recovery options?

Measured: renaming one option name made a spent password-reset link work again, and renaming a timestamp field routed the request around the token comparison entirely, so a wrong token was accepted. Protection alone was clean on all five profiles.

Read article ›

Data Lifecycle · New 2026-08-17 ~10 min read

Does obfuscation break data retention policies?

Measured: renaming one option name widened a nightly purge from one collection to every collection, destroying statutory invoices and the audit trail. Renaming a second name alongside it made the damage vanish - which is why a clean combined result proves nothing about its halves.

Read article ›

Fraud Prevention · New 2026-08-17 ~10 min read

Does obfuscation break risk scoring rules?

Measured: renaming a weight field did not zero the fraud score, it made the score not-a-number - and every threshold comparison against not-a-number is false, so a card-testing order scored 75 was allowed. Renaming a polarity flag blocked a four-year customer instead.

Read article ›

Privileged Access · New 2026-08-17 ~10 min read

Does obfuscation break support impersonation controls?

Measured: a full customer-database export was guarded three separate ways, and each guard lost alone still refused it - only the reason changed. One pattern reached all three and the export went through, written into the audit trail as a normal support action.

Read article ›

Audit Evidence · New 2026-08-17 ~10 min read

Does obfuscation break audit log integrity?

Measured: renaming one option name switched off the hash chain, so a deleted row went undetected and the trail still reported itself intact. Renaming a field name wrote a full card number into the trail. The chain checks themselves failed closed, which is the good news.

Read article ›

Bot Defence · New 2026-08-17 ~10 min read

Does obfuscation break bot and CAPTCHA verification?

Measured: renaming one option name accepted a CAPTCHA token solved on the attacker's own domain. Another let one paid solve unlock five logins instead of one. A third turned an unreachable challenge service from an outage into an open door. Protection alone was clean on all five profiles.

Read article ›

Privacy · New 2026-08-17 ~10 min read

Does obfuscation break session replay masking?

Measured: two masking rules deliberately covered the same card field, and each one alone was harmless. One pattern reached both and put a full card number on a replay vendor's servers. A separate arm defeated the password mask the recorder will not let you switch off. Protection alone was clean on all five profiles.

Read article ›

AI Agents · New 2026-08-17 ~10 min read

Does obfuscation break AI agent tool permissions?

Measured: an allowlist of callable tools and a denylist of tools needing human approval sat side by side on one options object. One pattern reached both. The allowlist failed closed and the denylist failed open, and a refund the agent was never allowed to issue executed unattended. Protection alone was clean on all five profiles.

Read article ›

Access Control · New 2026-08-17 ~10 min read

Does obfuscation break geo and IP access rules?

Measured: a sanctioned country was covered by both a denylist and a serving allowlist, and losing either alone only changed the log line. One pattern reached both and the sanctioned request was permitted. A separate arm let an address the geo database had never seen in by default. Protection alone was clean on all five profiles.

Read article ›

Measurement · New 2026-08-17 ~10 min read

Does obfuscation break callback result objects?

Measured across six areas: when you hand a library your own guard function, the shape of what it returns is part of the contract too. Rename those result fields and the guard still runs, still decides correctly, and its answer is discarded. Four of six failed closed and loudly. The one that failed open was the one whose flag meant deny rather than allow.

Read article ›

Authentication · New 2026-08-17 ~10 min read

Does obfuscation break passkey verification options?

Measured: renaming two option names let an assertion captured on a look-alike domain authenticate successfully - the one attack passkeys exist to prevent. Another let an attacker's own passkey confirm somebody else's account. Protection alone was clean on all five profiles.

Read article ›

Client-side storage · New 2026-08-17 ~10 min read

Does obfuscation break IndexedDB options?

Measured: one renamed pattern left a card number sitting in the browser profile in plain text while the application's own telemetry still reported the redactor as installed and running. Another let two accounts share one email address. Protection alone was clean on all five profiles.

Read article ›

Privacy and compliance · New 2026-08-17 ~10 min read

Does obfuscation break consent and tracking preferences?

Measured: renaming one flag turned a prohibition into a permission and the engine reported a category as permitted because a rule matched. Another profiled a fourteen-year-old who the site's own gate had refused. Protection alone was clean on all five profiles.

Read article ›

Search and data access · New 2026-08-17 ~10 min read

Does obfuscation break search query options?

Measured: a tenant filter and an authorization callback were each individually harmless, and losing both served one customer's documents to another. A separate arm returned a salary field to the browser. Protection alone was clean on all five profiles.

Read article ›

Media and DRM · New 2026-08-17 ~10 min read

Does obfuscation break DRM playback options?

Measured: renaming one option played a 4K title with no DRM at all on a device that fully supports it, while the player reported playback as normal. Two output-protection options each opened UHD to an unprotected output on their own. Protection alone was clean on all five profiles.

Read article ›

Scheduling and background work · New 2026-08-17 ~10 min read

Does obfuscation break scheduled job options?

Measured: renaming one option moved the nightly billing run four hours earlier, another let two copies of it run at once and bill every customer twice, and a third let a replica that should never have started run it at all. Protection alone was clean on all five profiles.

Read article ›

Offline and caching · New 2026-08-17 ~10 min read

Does obfuscation break service worker caching?

Measured: renaming one option handed a signed-in customer's account page, card digits included, to the next visitor with no session at all. Another kept a revoked administrator an administrator. Protection alone was clean on all five profiles.

Read article ›

Update and supply chain · New 2026-08-17 ~10 min read

Does obfuscation break software update checks?

Measured: renaming one boolean let a build nobody signed install itself, while the application still reported the strong signature verifier as installed - because it was, and was simply never called. Protection alone was clean on all five profiles.

Read article ›

Backup and recovery · New 2026-08-17 ~10 min read

Does obfuscation break backup and restore options?

Measured: renaming either half of a two-part guard wrote last night's archive in plain text, card numbers readable. Another arm put the release signing key into the backup, and a third silently cut ninety days of retention to seven. Protection alone was clean on all five profiles.

Read article ›

Notifications and delivery · New 2026-08-17 ~10 min read

Does obfuscation break push notification options?

Measured: renaming one option put a full card number and email address on a locked phone screen. Another delivered a ten-minute login code sixteen hours later, and a third turned one order notification into twelve. Protection alone was clean on all five profiles.

Read article ›

Transactions and consistency · New 2026-08-17 ~10 min read

Does obfuscation break transaction isolation options?

Measured: renaming one column name let two withdrawals of 60 succeed against a balance of 100 while the balance stayed at 100, and it switched off the conflict detection that was supposed to stop them. Protection alone was clean on all five profiles.

Read article ›

Encryption at rest · New 2026-08-17 ~10 min read

Does obfuscation break envelope encryption options?

Measured with real node crypto: renaming one option downgraded AES-GCM to AES-CBC, so an edited ciphertext decrypted to an attacker-chosen amount and the encryption context stopped being enforced at all. Protection alone was clean on all five profiles.

Read article ›

Serving user files · New 2026-08-17 ~10 min read

Does obfuscation break file download headers?

Measured: two renamed options together served a user-uploaded HTML file as a page in the application's own origin, and a third let a filename write a Set-Cookie header of its own. Protection alone was clean on all five profiles.

Read article ›

Caching and disclosure · New 2026-08-17 ~10 min read

Does obfuscation break response cache directives?

Measured: renaming the response-cache options put a signed-in customer's page into a cache shared by every visitor, and the next anonymous request came back with their email, their card suffix and their session cookie. Protection alone was clean on all five profiles.

Read article ›

Payments · New 2026-08-17 ~10 min read

Does obfuscation break payment idempotency options?

Measured: renaming one option made a retried checkout charge the customer twice, and renaming another let the browser pay 99 cents for a 49.99 cart. Protection alone was clean on all five profiles.

Read article ›

Sessions and identity · New 2026-08-17 ~10 min read

Does obfuscation break session middleware options?

Measured: renaming one option on a session middleware left an attacker-planted session identifier signed in as the victim, and renaming another replaced 22 characters of application entropy with a counter. Protection alone was clean on all five profiles.

Read article ›

Configuration and merging · New 2026-08-17 ~10 min read

Does obfuscation break configuration merging?

Measured: renaming one option on a deep-merge helper let a tenant configuration document write to Object.prototype, and renaming the same name the detector uses turned the alarm off in the same edit. Protection alone was clean on all five profiles.

Read article ›

Outbound requests and SSRF · New 2026-08-17 ~10 min read

Does obfuscation break outbound request controls?

Measured: renaming one option on an HTTP client followed a user-supplied link into an internal service and returned a database password, and renaming a second put cloud metadata credentials in the response body. Protection alone was clean on all five profiles.

Read article ›

Caching and tenancy · New 2026-08-17 ~10 min read

Does obfuscation break cache key namespaces?

Measured: renaming one option on a cache client served one tenant's user record to another tenant, and renaming the profile's own field names left the secrets the application filters out sitting in the shared cache. Protection alone was clean on all five profiles.

Read article ›

Uploads and media · New 2026-08-17 ~10 min read

Does obfuscation break image processing limits?

Measured: renaming one option on an image pipeline decoded a 61 KB upload into six gigabytes of pixels, and renaming another published a photograph with its GPS coordinates intact. Protection alone was clean on all five profiles.

Read article ›

Cross-site request forgery · New 2026-08-17 ~10 min read

Does obfuscation break CSRF token verification?

Measured: renaming one option on a CSRF middleware made a token minted in an attacker's own session validate against a victim's, and renaming a second made the library accept a token out of the query string that the application had deliberately stopped reading. Protection alone was clean on all five profiles.

Read article ›

Authorization · New 2026-08-17 ~10 min read

Does obfuscation break permission rules?

Measured: renaming one key on a permission rule turned a prohibition into a permission, and renaming another dropped the row filter so a finance user could read every organisation's invoices. Both arms answered allowed=true with no error anywhere. Protection alone was clean on all five profiles.

Read article ›

Query safety · New 2026-08-17 ~10 min read

Does obfuscation break NoSQL query options?

Measured: renaming one query option let an operator object injected into a sign-in filter match users again, and renaming a second put the password hash and the MFA secret into the API response. A third arm failed closed on reads and open on writes in the same run. Protection alone was clean on all five profiles.

Read article ›

Realtime transport · New 2026-08-17 ~10 min read

Does obfuscation break WebSocket server options?

Measured: renaming one option on a WebSocket server removed the origin check entirely, so a page on an attacker's site completed a handshake with the victim's cookie attached. Renaming another took the per-message cap from 64 KB to 100 MiB. Protection alone was clean on all five profiles.

Read article ›

Multi-factor authentication · New 2026-08-17 ~10 min read

Does obfuscation break one-time code verification?

Measured: renaming either half of an application-supplied replay cache made a one-time code that had already been used accepted a second time, with the verifier still reporting success. Renaming the window option widened acceptance from 30 seconds to 90. Protection alone was clean on all five profiles.

Read article ›

Parsing untrusted input · New 2026-08-17 ~10 min read

Does obfuscation break XML and YAML parser options?

Measured: renaming one option on a markup parser turned it into a file-read primitive that pulled /etc/passwd and the process environment off disk and into parsed output. Another took an entity bomb from 68 expansions to 11,111, and a third constructed a language-specific tag the safe schema exists to refuse.

Read article ›

Rendering user data · New 2026-08-17 ~10 min read

Does obfuscation break template escaping options?

Measured: renaming the autoescape option put a live script tag into rendered HTML. The more interesting arm renamed only the escaper: escaping still ran, the script tag was still neutralised, and an attacker still broke out of an HTML attribute - because the engine's own escaper does not touch quotes.

Read article ›

Outbound mail · New 2026-08-17 ~10 min read

Does obfuscation break mail transport options?

Measured: renaming two options on a mail transport attached the application's own .env file and a cloud metadata response to an outgoing email, so a live API key and a set of instance credentials left the host as attachments. A third sent SMTP credentials over the wire in plaintext.

Read article ›

Serving files · New 2026-08-17 ~10 min read

Does obfuscation break static file serving options?

Measured: renaming the root option on a static-file middleware served a private key from one level above the public directory. Renaming a different option returned 200 for the same URL with the app shell instead - identical status code, completely different meaning, and only one of them is a breach.

Read article ›

Observability · New 2026-08-17 ~10 min read

Does obfuscation break telemetry sampling options?

Measured: renaming the redaction list on a telemetry exporter sent a bearer token, a card number, a session cookie and a SQL statement containing a customer email address to a third-party endpoint verbatim. Nothing failed, nothing was logged, and every span still arrived.

Read article ›

Request handling · New 2026-08-16 ~10 min read

Does obfuscation break request body limits?

Measured: renaming the options on a body parser raises an 8 kB limit to the library's 100 kB default, lets 400 form parameters through, and - when the compression switch goes with it - accepts a gzip body that expands to fifteen times its declared size. Your own config dump keeps printing the old number.

Read article ›

Upload handling · New 2026-08-16 ~10 min read

Does obfuscation break file upload limits?

Measured: renaming the options on a multipart upload route turns every size and count cap into Infinity, admits a PHP file through a filter that used to reject it, and moves the whole upload from disk into memory - 41 MB buffered in RAM from one request, with nothing rejected and no error raised.

Read article ›

Authorization · New 2026-08-16 ~10 min read

Does obfuscation break OAuth client options?

Measured: renaming an OAuth client's option keys removes the CSRF binding on the callback, downgrades PKCE to the specification's plain default, admits a replayed id_token, and turns a one-scope request into a token carrying every scope the client is registered for. Every one of those requests is protocol-legal.

Read article ›

Object storage · New 2026-08-16 ~10 min read

Does obfuscation break presigned URL options?

Measured: renaming the options that scope a presigned object-storage URL stretches a one-minute link to fifteen minutes, removes the size and content-type conditions from an upload policy, and drops the key constraint so an uploader can write anywhere in the bucket - including over the object at its root.

Read article ›

Network identity · New 2026-08-16 ~10 min read

Does obfuscation break proxy trust settings?

Measured: renaming one option collapses every caller in the world onto your load balancer's address - which opened an admin allowlist scoped to the internal range to the entire internet. Renaming its neighbour does the opposite and honours a forged forwarded header from anyone.

Read article ›

Cross-site scripting · New 2026-08-16 ~10 min read

Does obfuscation break HTML sanitizer configuration?

Measured: member renaming can drop a sanitizer allowlist so the library falls back to its own defaults, re-admitting protocol-relative URLs, target attributes, plain http links and tags you had deliberately removed - with no error anywhere.

Read article ›

Browser security headers · New 2026-08-16 ~10 min read

Does obfuscation break Content-Security-Policy headers?

Measured: renaming the keys of a CSP policy object serialises those names straight into the header, where a browser silently ignores every directive it does not recognise - so the header is present, the response is 200, and nothing is enforced.

Read article ›

Cross-origin access · New 2026-08-16 ~10 min read

Does obfuscation break CORS policy options?

Measured: renaming the origin key of a CORS options object reverts the middleware to its documented default of a wildcard, so an origin allowlist becomes Access-Control-Allow-Origin star with no error and no failing request.

Read article ›

Abuse prevention · New 2026-08-16 ~10 min read

Does obfuscation break rate limiter configuration?

Measured: renaming the window, the ceiling or the key function of a login rate limiter silently multiplies the password guesses an attacker gets, and renaming the limiter's own result fields disables blocking entirely with no error.

Read article ›

Supply chain · New 2026-08-16 ~10 min read

Does obfuscation break archive extraction guards?

Measured: renaming the filter option on an archive extraction removes the allowlist from the pipeline entirely, so an environment file, a shell script and a path outside the target directory were all written - and renaming the byte cap wrote forty megabytes where zero belonged.

Read article ›

Cryptography · New 2026-08-16 ~10 min read

Does obfuscation break key generation and signing options?

Measured: member renaming can strip the cipher and passphrase from a private key export, so the key lands on disk unencrypted with no error, and it can silently downgrade an RSA-PSS signature to PKCS#1 v1.5.

Read article ›

Data Layer · New 2026-08-16 ~10 min read

Does obfuscation break embedded database options?

Measured against node:sqlite: renaming readOnly turned a reporting connection writable and a stray UPDATE landed on the ledger, while renaming a relaxed foreign-key switch broke a bulk import that had been working.

Read article ›

Input Validation · New 2026-08-16 ~10 min read

Does obfuscation break mass assignment guards?

Measured with class-validator: renaming the whitelist option let an isAdmin flag from the request body reach the entity, and the same rename turned the request that should have been rejected into a silent success.

Read article ›

Observability · New 2026-08-16 ~10 min read

Does obfuscation break log redaction?

Measured with util.inspect: renaming the depth and string-length switches put a full session token into a log line that had been 54 characters, and renaming a name your own code owns changed the field name in the log itself.

Read article ›

Authentication · New 2026-08-16 ~10 min read

Does obfuscation break token verification rules?

Measured with jose: renaming the issuer, audience, algorithms, required-claims and max-age keys in a verification policy admitted five tokens that had been refused, and renaming the whole policy object admitted every one of them.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break TLS and Certificate Options?

A TLS connection is configured through an options object whose names node fixes. Protection alone is clean on all five profiles. Member renaming silently downgraded a service that pins TLS 1.3 onto TLS 1.2, let an anonymous client hold a session on a server that requires client certificates, and dropped the cipher pin, the ALPN protocol and the SNI name without an error anywhere.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Sandbox and VM Options?

A sandbox is only as strong as the options object that configures it. Protection alone is clean on all five profiles. Member renaming let a runaway plugin run to completion against a 60 millisecond budget, re-enabled code generation from strings inside the sandbox, returned control while the plugin was still pending, and erased the tenant name from the incident frame.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Compression Options?

Compression levels, output caps and window sizes are properties on an options object the zlib bindings read. Protection alone is clean on all five profiles. Member renaming removed the cap that stops a decompression bomb, so a 24 kilobyte upload expanded to 24 megabytes and was accepted, and it turned a deliberately cheap compression path into the expensive default.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Server Timeouts and Limits?

An HTTP server's request timeout, headers timeout, keep-alive and header size cap are properties on one options object. Protection alone is clean on all five profiles. Member renaming served an oversized header block with a 200, let a slow-drip upload run past every deadline, and disabled the request timeout entirely through an option nobody thinks of as a security control.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break DNS and Socket Options?

Address family, resolver budgets and socket timeouts are properties on option objects the dns and net modules read. Protection alone is clean on all five profiles. Member renaming resolved an IPv4-only service to an IPv6 address, changed the shape of a lookup result from an array to a string, and left a socket waiting on a wedged upstream with no timeout at all.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Cookie Attributes?

HttpOnly, Secure, SameSite and Max-Age are read out of an options object by whatever writes your Set-Cookie header. Protection alone is clean on all five profiles. Member renaming dropped the flags from the emitted header, made a session cookie readable by script, turned logout into a no-op, and left the application's own security self-check reporting no findings.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Allowlists and URL Validation?

A validation library reads your policy out of an options object. Protection alone is clean on all five profiles. Member renaming did not make the checks fail; it reverted them to the library's defaults, so an off-host redirect target was accepted, a plain HTTP URL passed an https-only rule, a blocked mail domain was allowed, and a numeric bound stopped applying.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Your Web App Manifest?

A web app manifest generated in JavaScript is a document whose keys the browser fixes. Protection alone is clean on all five profiles. Member renaming published a valid JSON file that no longer describes an installable app: no launch URL, an untitled install prompt, no icons, an empty jump list, and a service worker update policy that reverted to the default.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Password Hashing Parameters?

Node reads cost parameters, key encodings and authentication tag lengths out of ordinary option objects. Protection alone is clean on all five profiles. Member renaming made every stored password stop verifying while the record beside the hash still claimed the strong cost parameter, and made an authenticated cipher accept a truncated tag.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Glob and Ignore Patterns?

Ignore patterns are strings and keep working. The switches that qualify them are properties on an options object. Protection alone is clean on all five profiles. Member renaming walked a capitalised test file into the published artifact while the packager's own leak audit still reported nothing.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Feature Flags and Remote Config?

A flag payload is written by a service you do not build with. Protection alone is clean on all five profiles. Member renaming turned a shipped feature off, turned a disabled feature back on, made a 25 percent rollout reach everybody, and left the operator report saying every flag was off while a disabled feature was running.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Named Capture Groups?

A regular expression survives protection byte for byte, so the group names inside it never move. The reads of those names do. Protection alone is clean on all five profiles; member renaming left the numbered groups and the replacement pattern working perfectly while every named read returned undefined, and turned a valid identifier into a rejected one.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Property Descriptors?

The dictionary you hand Object.defineProperty is read by the JavaScript engine, which makes its keys an external contract. Protection alone is clean on all five profiles. Member renaming produced an object that serialises as empty with every value intact, an accessor that quietly became a value, and a read-only property that accepted a write into a second field.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break OpenAPI and Generated Clients?

An API description your build emits is an object literal whose key names are fixed by a specification and read by tools you do not ship. Protection alone is clean on all five profiles. Member renaming published a document with a generated key at the top level, produced an empty client from a valid-looking file, and named every generated method after a fallback string.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break AST Tools and Codemods?

A parser writes the node objects your tool reads, and your visitor object is read by the traversal library. Protection alone is clean on all five profiles. Member renaming produced a linter that reported a file clean, a codemod that reported zero changes, and a summary marked ok, all without visiting a single node.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Plugin and Extension APIs?

A plugin API is a contract with code you did not build and cannot rebuild. Protection alone is clean on all five profiles. Member renaming makes a valid plugin fail its own load check, throws the error inside the vendor's code rather than yours, and in a two-build experiment made a host print a plugin's setup function where the plugin name belongs.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Background Jobs and Queues?

A job payload is written by one process and executed by another, often from a different release. Protection alone is clean on all five profiles. Member renaming made every job unroutable, removed the retry limit so an exhausted job ran again, and emptied the dead-letter log while jobs were still being parked.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break File System Options?

File system options do not carry data, they carry permission and limits. Protection alone is clean on all five profiles. Member renaming turned an exclusive-create guard into a silent overwrite, turned an append into a truncation, and made a copy exclusion stop excluding -- none of which raised an error.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break GraphQL Resolvers?

A resolver map is an object literal whose keys must equal the field names in your schema, and the schema is text that every shipped client already agrees with. Protection alone is clean on all five profiles. Member renaming made every field resolve to null while the response kept its shape, and made a conformance check report implemented fields as unimplemented.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Package Manifests and Module Resolution?

A build that writes a package manifest is writing a file node reads back with its own resolver. Protection alone is clean on all five profiles. Member renaming made node fail to resolve a generated entry point, dropped the version out of every crash report, and left a build that reads its own manifest reporting no dependencies at all.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Database Rows and ORM Models?

A database driver builds row objects from the column names in your SQL, so the property names on a row are not written by your bundle. Protection alone is clean on all five profiles measured against a real driver. Member renaming makes every column read undefined, turns order totals into NaN, drops columns out of the JSON you send onward, and makes the driver reject a named parameter it has never heard of.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break HTTP Request Handlers?

Request headers, query parameters and JSON bodies are written by the caller and by the runtime, not by your bundle. Protection alone is clean on all five profiles measured against a real server. Member renaming makes query values read undefined, drops fields out of the reply, throws at the first header access, and -- in the sharpest arm -- sends a request to a different host entirely.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Server-Sent Events and Log Streams?

Every record in a log feed or an event stream is written by the sender. Protection alone is clean on all five profiles measured. Member renaming turns an error stream into an empty one, collapses grouped totals into a single bucket named undefined, silences the alert that exists to page someone, and makes an event parser discard every frame before failing.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Health Checks and Metrics?

Memory figures, CPU times and resource usage come out of objects the runtime builds, so their property names belong to the platform. Protection alone is clean on all five profiles measured. Member renaming makes a health endpoint report degraded, a memory threshold alert that can never fire, and a container read that throws before the process finishes starting.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Multi-File Builds?

Protecting two files in separate runs does not just make them fail to find each other's property names. Measured here: each run restarts its own counter, so the same generated name means a different property in each file, and every value arrives intact and attached to the wrong name. Protecting the same code in one run was correct in every read.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Form Fields and FormData?

A form's field names are written by the browser from your HTML, and read by your server. Nothing in the bundle authors them. Protection alone is clean on all five profiles measured. Member renaming makes every field read as undefined, puts a generated identifier into the request body and into the message the user is shown, and turns a ticked checkbox into an unticked one.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break CSV and Spreadsheet Imports?

A CSV header row is written by whoever exported the file, and parsing it into row objects renames nothing. Protection alone is clean on all five profiles measured. Under member renaming the column reads return undefined, totals become NaN, and the record written back out does not contain a wrong value for the column -- it does not contain the column at all.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Schema Validation?

A validation schema is a literal in your source; the payload it validates comes from a caller. Protection alone is clean on all five profiles measured. Under member renaming the two sides stop agreeing, and the failure is not a crash: valid requests are rejected for a field the caller never sent, the caller's real field is reported as unknown, and type errors stop being reported at all.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Webhooks and Signature Verification?

A webhook body is written and signed by a sender you cannot redeploy. Protection alone is clean on all five profiles measured, signature check included. Under member renaming the signature still verifies and the handler goes wrong afterwards: events route to the ignore branch, and a second, entirely different event is silently discarded as a duplicate of the first.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Analytics Events?

Analytics property names are the one contract where your bundle writes the keys and something you never deploy reads them. Protection alone is clean on all five profiles measured. Under member renaming every read inside the application stays correct and only the JSON leaving the process changes, so nothing breaks except the dashboards, funnels and alerts built on those names.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Error Codes and errno?

Every error-handling branch in a Node program tests a property the runtime wrote, not one your build did. Protection alone leaves that intact on all five profiles measured. Member renaming turns err.code into undefined, and because no comparison against undefined ever matches, every dispatch quietly falls through to its else branch: missing files become unexpected failures, and a transient error stops being retried.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break JSON Config Files?

The keys in a config file are written by whoever edits that file, and parsing it does not rename anything. Protection alone is clean on all five profiles. Member renaming produces the quietest failure this site has measured: a config file that is present, valid, and completely ignored, while the validator that is supposed to catch exactly that reports no problems at all.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Command-Line Flags?

A CLI's option keys are built at runtime out of the text the user typed, so they are a contract with a person rather than with your code. Protection alone is clean on all five profiles. Member renaming makes every flag revert to its default without a word of complaint -- including, in the measured run, the safety flag that was the only thing standing between the tool and overwriting a file.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Saved State and Migrations?

Stored state is the one contract whose other party is your own past build, and it cannot be redeployed. Protection alone is clean on all five profiles. Under member renaming, the measured worst case is not lost data: it is a release that reads yesterday's record one slot out of step, so every value is present, intact, and attached to the wrong name.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Environment Variables and Build Config?

Protection on its own leaves configuration alone: every arm of an environment-driven config module measured identically across five profiles. Member renaming is where it gets interesting, because an environment variable name is a contract with whatever sets it, and the one build that reads a renamed name does not fail loudly. It silently identifies itself as the wrong release channel.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break JWT and Token Claims?

A token is authored by a server and arrives as base64 JSON, so its claim names are a contract your build does not own. Protection alone leaves them alone. Member renaming produces one loud failure, one silently truncated payload, and an expiry check that stops rejecting expired tokens.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Child Process and Worker Options?

Node reads spawn and worker option dictionaries inside the runtime, so those key names are a contract your build does not own. Protection alone is clean on every profile. Member renaming produces a child that inherits the whole parent environment, a working directory that is silently wrong, an output cap that stops capping, and a string that quietly becomes a Buffer.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break String Property Paths?

A path written as a string -- a lodash get, a mustache placeholder, a grid column key, a JSON Pointer -- is data, and data is not renamed. The properties it names are. Under member renaming that gap produces a lookup that returns its fallback, a template that shows the placeholder to the user, and a write that lands in the wrong place while the read-back looks merely stale.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Destructuring and Default Values?

Destructuring survives obfuscation intact in the default configuration, across parameters, nested patterns, array patterns, rest elements and catch clauses. Turn member renaming on and a pattern key becomes a property read like any other, with one specific shape that desynchronises silently and substitutes its default.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Async Iteration?

The article on async and await explicitly declined to cover for await and async generators, and the article on iterators and generators found a real defect in the synchronous protocol. This one measures the asynchronous half: ordering, interleaving, early exit, cleanup, delegation and rejection all survive on every profile, including the target where synchronous for-of does not.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Your State Management Store?

Action types, payloads, reducers and selectors all survive member renaming, because both halves of every one of those contracts live in your own code. The state that leaves your process does not, and one very ordinary field name collides with a built-in array method.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break i18n Message Catalogs?

Two catalogs with identical content, one written as a JavaScript object and one loaded as data. Under member renaming the first shows users raw message keys and the second is untouched. The interpolation parameters break both, which is why the obvious mitigation is only half a fix.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Iterators and Generators?

Four other articles on this site defer to this one, and they are right to. On the default output target a for-of loop over a generator is rewritten into a loop over an array, which drains the generator completely before your loop body runs even once. The values are correct and almost everything else about the loop is not.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Iterator Helpers?

A lazy chain of map, filter, take and toArray over an infinite generator came through five protection configurations byte-identical, laziness included. What breaks is member renaming, and the boundary is sharp: helper chains over built-in sources survive renaming the iteration protocol, while the same chain over an iterable you wrote does not.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Set Operations?

Union, intersection, difference and the subset predicates came through five protection configurations unchanged. The measured failure is a set-like object of your own: the platform reads size, has and keys off it by name, and renaming one of them produced an error message that names a property sitting in plain sight in your source.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Memoization and Caches?

Memoization, string cache keys and an LRU with its own bookkeeping all came through five protection configurations unchanged. Then one renamed property stopped the eviction step without stopping the counter that reports it, so the cache grew past its limit while its own metrics said it had evicted.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break fetch and Request Options?

A POST with headers, a body and a redirect policy came through five protection configurations byte-identical. What breaks is member renaming reaching the init dictionary, and the sharpest measured case is a POST that the platform rejects as a GET while your source still plainly reads POST.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Abort Signals and Cancellation?

AbortController, its signal, its reason and a timeout signal all survived five protection configurations unchanged. Member renaming produces the worst possible failure for a cancellation primitive: a guard that always reports the work was not cancelled, with nothing thrown and nothing logged.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break addEventListener Options?

Event registration, dispatch and custom event payloads survived five protection configurations unchanged. Member renaming reaching the options dictionary produced the measured result that a once-only listener fired on every dispatch and an aborted listener kept running, with nothing thrown.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break TextEncoder and TextDecoder?

Encoding and decoding, including accented text, an em dash and a byte order mark, came through five protection configurations unchanged. Member renaming reaching the decoder options turned a validating decoder into a permissive one and corrupted a character split across two streamed chunks.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Intl and Locale Formatting?

Currency, date, plural and collation formatting came through five protection configurations byte-identical. The break is member renaming reaching the options object, and it does not throw: a currency amount quietly formats as a plain decimal and a date lands on the wrong calendar day.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break the User Timing API?

Marks, measures and their durations survived five protection configurations unchanged, because a mark name is a string and strings are not rename sites. What breaks is reading the entry objects the platform hands back, and the failure looks like a performance dashboard full of blanks.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break WeakRef and FinalizationRegistry?

A WeakRef dereferenced to the identical object and a FinalizationRegistry accepted its registrations and unregister token across five protection configurations. The surface is unusually small: only the platform method names can be broken, and the held value is yours to name.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Retry and Backoff Configuration?

A retry helper with an exponential backoff schedule and a circuit breaker survived every protection configuration, including member renaming of its own options object. It stops surviving the moment that object is loaded from JSON, and the failure is a silent revert to defaults with a NaN delay.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break WebAssembly Interop?

A WebAssembly module compiled, instantiated, called its imported callback and returned the same value in all five configurations. The break is member renaming reaching the import object, whose keys are strings compiled into a binary the JavaScript obfuscator never opens.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Error Cause Chains?

Error cause chains, AggregateError and the walk a crash reporter does over them measured identical in all five configurations. Member renaming breaks them two ways, and the quieter one leaves your reporter shipping the word undefined instead of a message.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break toSorted, with and the New Array Methods?

The non-mutating array methods and Object.groupBy measured identical in all five configurations, including non-mutation and comparator stability. The measured curiosity is that arr.with survives member renaming while arr.at does not, and the reason is that with is a reserved word.

Read article ›

Compatibility · New 2026-08-16 ~10 min read

Does Obfuscation Break Tagged Templates?

Tagged templates keep the per-call-site caching and the frozen strings array that css-in-js, lit-html and graphql-tag memoise on, measured across five configurations. The breaks are member renaming reaching strings.raw or length, and both are loud.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break UMD and module wrappers?

A UMD wrapper picked the same branch before and after protection in all five configurations, including the AMD and global-fallback paths. Letting member renaming match exports turns module.exports into a generated name and ships a package that exports nothing without throwing.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break duck typing and capability checks?

Code that decides what an object is by asking which members it has measured identical in five configurations. Member renaming breaks it two measured ways: a real promise stops being recognised as thenable, and a validator driven by a list of required names reports every field missing.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break streams and backpressure?

Reader loops, transform streams and cancellation measured identical against node's real WHATWG streams. Member renaming reaching the underlying-source callbacks produces the quietest failure on this site: no chunks, no output, no error and a successful exit.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break undefined and optional reads?

Absent, undefined and null stayed distinguishable in all five configurations, along with void 0, an array hole and a local that shadows undefined. The one measured break is an optional read addressed by a string key while member renaming rewrites the declaration.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break Function.name and reflection?

Identifier renaming changes fn.name, constructor.name and the parameter names readable through Function.prototype.toString, while arity and the native-code marker survive. Name-keyed registries and implicit dependency injection are the two patterns that break.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break Web Crypto?

Digests, HMAC signing and an AES-GCM round trip measured byte-identical against a real WebCrypto implementation in five configurations. The one way to break it is pointing member renaming at the algorithm dictionary or the SubtleCrypto method names.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break data-* attributes and dataset?

Attribute reads, the dataset camelCase bridge, selector strings and class lists all measured identical. Member renaming reaching a dataset key detaches your JavaScript from your HTML silently, producing undefined, NaN and false rather than an error.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break eval and new Function?

The Function constructor, indirect eval and string-built helpers behave identically, and their source text passes through unprotected. Direct eval that reads a renamed local stops resolving, which is the one measured break.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break date and time handling?

ISO round trips, epoch arithmetic, UTC field access, month and day normalisation, leap years and fixed-locale formatting all measured identical. The surprises in this area belong to the Date API, and protection preserves them faithfully.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break Promise.all and Promise.race?

All four combinators, thenable adoption, AbortController and microtask ordering measured identical. The real hazard is member renaming reaching then, status, value or reason, which we measured breaking hard.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break try, catch and finally?

The finally return-override rule, rethrow identity, nested handler ordering, per-iteration finally with break and continue, and optional catch binding all measured identical on both targets.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break client-side routing?

Pattern compilation, parameter extraction, query parsing, history navigation and guards measured identical. Route strings are data, which is also why protection does not hide your route table.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation change evaluation order?

Argument order, postfix and prefix increment, compound assignment, the comma operator, short-circuiting and getter side effects all measured byte-identical. The sample was built to expose reordering and found none.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break your event emitter?

An emitter with on, off, once and emit measured identical, including with its own API renamed. Event names are strings and survive; the boundary to watch is a bus shared across separately protected bundles.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break URL and query string building?

URL, URLSearchParams, encodeURIComponent and relative resolution measured identical, including under the string table. What protection does not do is hide the endpoints your bundle calls.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break emoji and code points?

String length in code units, surrogate pairs, normalization, code-point iteration and the regexp u flag all measured identical. The bugs in this area are in the original code and are preserved faithfully.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break number formatting?

toFixed, toPrecision, toString with a radix, parseInt and parseFloat all measured byte-identical after protection, including the rounding cases that look like bugs. The only way to break them is a member pattern matching a built-in name.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break modern string methods?

replaceAll, padStart, trimStart, at and split with a limit measured identical, including under the string table that moves and encodes every literal. String identity and immutability hold too.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break type coercion?

Coercion, loose equality, truthiness and wrapper objects all measured unchanged. But renaming a member called valueOf or toString silently disables the protocol and yields [object Object] with nothing thrown.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break math and floating point?

Math methods, floating point results, 32-bit bitwise operators and a hand-written FNV-1a hash all measured byte-identical, and unparenthesised mixed-precedence expressions kept their values.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break frozen and sealed objects?

Object.freeze, Object.seal and property attributes measured identical after protection. The one shape that quietly changes is a property defined by string with defineProperty and then read by dot access under member renaming.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break closures and scope?

Closures, the module pattern, shadowing and loop capture all came through identical, including the per-iteration binding let gives in a loop on the ES5 target. Renaming is scope-aware, which is why.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break the arguments object and rest parameters?

The arguments object, rest parameters and spread at call sites measured identical, because almost nothing in variadic code is a name. One number does move: Function.length on the ES5 target.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break recursion?

Direct and mutual recursion, named function expressions and memoised recursive closures all measured identical, and stack depth headroom was measured rather than assumed.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break typed arrays and binary data?

Typed arrays, ArrayBuffer views and DataView endianness measured identical after protection, because binary code is built from index access and numeric arguments rather than from names.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break Map and Set?

Map, Set, WeakMap and structuredClone come through unchanged, including object identity as a key and insertion order, because a collection key is a value at run time rather than a name in the source.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break JSON serialization?

JSON.stringify and JSON.parse behave identically after protection, hooks included. The two ways member renaming does change your payloads are specific, silent and measured here.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break prototype chains?

Delegation, shadowing and instanceof all survive renaming because both ends of a lookup are rewritten together. Where a rename shows up is reflection by string, which names a property the transform never rewrote.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break JavaScript symbols?

Symbol-keyed properties and the well-known symbol protocols come through protection unchanged, because a symbol key is always a computed access and computed access is not one of the three places member renaming rewrites a name.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break this binding?

Renaming identifiers cannot move a receiver, because this is fixed by the shape of the call site rather than by any name. Methods, arrows, call, apply and bind all measured identical after protection.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break switch statements and string comparison?

The string table replaces literals with calls that return the same primitive strings, so strict equality, switch matching and fallthrough keep working. Measured with MoveStrings and EncodeStrings enabled.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation break sparse arrays and sort order?

Array holes stay holes, sort stays stable, and length keeps truncating, because array shape is runtime state that the transforms have no syntax to reach.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break getters and setters?

Accessor properties come through protection intact: the getter still computes, the setter still runs its side effect, and the property descriptor still reports enumerable. The one thing that moves is the accessor name.

Read article ›

What survives · New 2026-08-15 ~10 min read

Does obfuscation change object key order?

Key enumeration order is a specified property of JavaScript objects, and protection preserves it exactly: integer-like keys first, then string keys in insertion order, with Object.keys, for...in and JSON.stringify all agreeing.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break modern JavaScript operators?

Logical assignment, exponentiation, numeric separators and optional catch binding all come through with identical behaviour on both target versions, including the ES5 path that rewrites several of them into older syntax.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break async and await?

Async functions keep their exact ordering through protection: synchronous code still runs first, microtasks still run in the right place, and a rejected promise is still caught by the try/catch around it.

Read article ›

What survives · New 2026-08-15 ~10 min read

Your regular expressions are not obfuscated

A regular expression literal comes out of protection byte for byte identical to the way you wrote it. Named capture groups, lookbehind and Unicode property escapes are all still there in the shipped bundle.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break BigInt and large integer IDs?

BigInt literals, hex BigInt literals and values built with BigInt() all survive protection unchanged. The real hazard with large identifiers was already in your source before you protected anything.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break labeled statements?

Labels and their break and continue targets survive protection in both output targets, including through the rewrite that changes the shape of the loop they label.

Read article ›

What survives · New 2026-08-15 ~10 min read

What JavaScript obfuscation does not rename

An inventory of the things that come out of protection with their original text intact: regex literals, import specifiers, bracket-access keys, label names, private member names and exported names.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break Proxy, Reflect and defineProperty?

Member renaming rewrites dotted access and object-literal keys. It never rewrites a property name you hand to an API as a string, and that one asymmetry explains every metaprogramming failure people report.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break cross-tab messaging?

BroadcastChannel, SharedWorker and Web Locks coordinate several tabs of the same app. Two of the three carry property names between contexts, and the tabs are not always running the same build.

Read article ›

Diagnostics · New 2026-08-15 ~10 min read

Profiling and memory leaks in obfuscated JavaScript

Symbolication restores a stack trace. It does not restore a heap snapshot or a CPU profile, because those read names out of live objects rather than out of an error, and no mapping file is consulted.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break class private fields?

A private name is not a property name, and the engine has to treat it as its own kind of thing. Why hash-prefixed members are skipped by the member transform, why they stop a class being downlevelled, and the one class-field case that used to fail silently.

Read article ›

Browser Platform · New 2026-08-15 ~10 min read

Obfuscation and Permissions-Policy

Permissions-Policy is a header, so nothing in your bundle can edit it and an attacker holding your code cannot grant themselves a capability. It is also a common cause of failures that get blamed on the obfuscator.

Read article ›

Third-Party Scripts · New 2026-08-15 ~10 min read

Obfuscation and cross-site cookie access

If your script runs on other people's pages, its cookie access is a functional dependency that browsers are steadily restricting. Obfuscation neither helps nor hinders the migration, but it does change how you debug it.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break audio and paint worklets?

A worklet does not run in the window, and the runtime guards notice. Three of them behave three different ways in a worklet scope: one removes your only diagnostics, one silently installs nothing, and one fires its failure action on every legitimate load.

Read article ›

Modules · New 2026-08-15 ~10 min read

Obfuscation and import maps

An import map is JSON in your HTML, so no build step touches it and it stays as readable as you wrote it. Why module specifiers survive protection structurally, and what the map itself discloses about your module graph.

Read article ›

Threat Model · New 2026-08-15 ~10 min read

Obfuscation and short-lived access tokens

An API key and an access token are different objects, and advice that fits one fits the other badly. What actually bounds a token is lifetime, rotation and sender-constraining, none of which a build step provides.

Read article ›

Compliance · New 2026-08-15 ~9 min read

Obfuscation, export control and the encryption question

A transform that ships its decoder alongside the data withholds nothing, so it is not a cipher. Where real signing appears, and how a marketing word creates a classification problem.

Read article ›

Threat Model · New 2026-08-15 ~9 min read

Can attackers diff your releases to find the fix?

Ship a client-side fix and both versions of the file are public. What per-build polymorphic output does to that comparison, the four workflows that want a fixed seed instead, and why the diff was never the only route.

Read article ›

Integration · New 2026-08-15 ~9 min read

Your postMessage protocol is a public API

A message contract between your page and an embedded frame is a wire protocol anyone can watch and write to. The rename trap that breaks message keys silently, and the origin checks that are the actual control.

Read article ›

Build · New 2026-08-15 ~9 min read

Your security scanner cannot read your protected bundle

Static analysis follows names and string values, and the transform removes both. Which of your three scanner families actually cares, and the build order that keeps each one honest.

Read article ›

Performance · New 2026-08-15 ~10 min read

What runtime defense costs on the main thread

The transforms are cheap and the guards are not. The timer inventory at shipped defaults, why two wrappers forfeit cached compilation, and the verification that runs on every call into your bundle.

Read article ›

Threat model · New 2026-08-15 ~8 min read

Your WebRTC credentials are in your bundle

A WebRTC client has to present TURN credentials to open a relay session, so a static credential in the bundle is a working, billable relay account. What protection changes, and the ephemeral pattern that fixes it.

Read article ›

Threat model · New 2026-08-15 ~9 min read

Your random numbers run on their machine

A value generated in the browser is a value the user obtained first. Why crypto.getRandomValues fixes generator quality but not authority, and which draws have to move to the server.

Read article ›

Deployment · New 2026-08-15 ~8 min read

Protected JavaScript behind a corporate proxy

In enterprise networks a TLS-inspecting appliance decrypts, scores and sometimes rewrites your bundle before the browser sees it. Why breakage is confined to one customer, and how to prove it with a digest.

Read article ›

Runtime Defense · New 2026-08-15 ~9 min read

Your debug-protection timer fires on a backgrounded tab

The debugger-pause check measures the gap between timer ticks, and a browser throttling a hidden tab produces the same gap. The arithmetic behind the defaults, and how to tune it so it reports instead of breaking the page.

Read article ›

Compatibility · New 2026-08-15 ~8 min read

Does obfuscation break cross-origin isolation?

Isolation is decided by response headers, which a code transform never emits. The real intersections are the hidden frame two runtime wrappers use for untampered built-ins, cross-origin delivery, and one timing check that is unaffected.

Read article ›

Boundaries · New 2026-08-15 ~10 min read

Can you lock JavaScript to a device?

Domain, browser and operating-system locks read values the client volunteered about itself, and two of them only compare two self-reported strings. What the guards do, why they fail rather than skip, and what binding actually requires.

Read article ›

Disclosure · New 2026-08-15 ~9 min read

A bug bounty report says your obfuscated JavaScript was reversed

Recovering readable form from delivered JavaScript is not itself a vulnerability, and your policy should say so first. How to triage what the researcher actually found, and which findings deserve payment.

Read article ›

Boundaries · New 2026-08-15 ~10 min read

Your machine learning model is not obfuscated

Browser-side inference ships four things and only one of them is JavaScript you wrote. Why the weights file is never a candidate for the protection step, and which part of the pipeline is the real asset.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Will runtime defense block AI browser agents?

Agent extensions patch exactly the platform functions the integrity guard watches. What the default watch list contains, why pre-existing patching does not clear, and which failure action to choose.

Read article ›

Boundaries · New 2026-08-15 ~10 min read

Obfuscating htmx and Alpine apps: your logic is in the markup

An HTML attribute is not JavaScript, so the protector preserves it exactly and protects nothing in it. The renaming options that silently break an Alpine expression, and the exclusion list that prevents it.

Read article ›

Boundaries · New 2026-08-15 ~10 min read

Obfuscating ad tech JavaScript fights the channel that delivers it

A creative never runs on your hostname, so the domain lock fails before it reads the allowlist. Why the runtime guards misfire in a multi-party page, and what is genuinely worth protecting on the publisher side.

Read article ›

Compatibility · New 2026-08-15 ~10 min read

Does obfuscation break islands and streaming SSR?

Some script on the page came from your build and some was written by the server moments before it arrived. What that means for hydration payloads, and the one failure mode that breaks these architectures.

Read article ›

Boundaries · New 2026-08-15 ~10 min read

Protecting WebUSB and Web Serial device code

The permission prompt is the security boundary, and obfuscation changes no authority at all. What is worth protecting in a hardware-facing web app, and why the real control belongs in the firmware.

Read article ›

Boundaries · New 2026-08-15 ~10 min read

Your bot detection code runs on the bot

Anti-automation script is delivered to the machine it is meant to evaluate. Why the common bypass never reads your code, what per-build polymorphic output genuinely buys, and why a fixed seed is the wrong choice here.

Read article ›

Boundaries · New 2026-08-14 ~9 min read

Your WebGL shaders are not obfuscated

A shader is not JavaScript. It is a string handed to another compiler and it must arrive intact, so it is recoverable at the API boundary in one step. Why excluding shader source from the string transforms is usually right.

Read article ›

Compatibility · New 2026-08-14 ~9 min read

Does obfuscation change your browser support matrix?

A protector is a source-to-source transform, not a transpiler, so it emits the language level it read. Why there is no ECMAScript target option, what syntax the injected guards use, and the build order that keeps a wide matrix intact.

Read article ›

Runtime defense · New 2026-08-14 ~9 min read

Your JavaScript expiry date runs on their clock

A date lock reads the local calendar on the user's own machine, with no network involved. What that makes it good for, what it cannot hold against, and how to pair it with a server-side deadline.

Read article ›

Compatibility · New 2026-08-14 ~9 min read

Does obfuscation break internationalization?

Translated text is data and obfuscation transforms code, so in the usual setup nothing happens. The exceptions that matter: bundled catalogues, message lookup through renamed members, and extraction tooling run in the wrong order.

Read article ›

Build integration · New 2026-08-14 ~9 min read

Obfuscating over-the-air JavaScript updates

A hot-pushed bundle is the same artifact the packager would have embedded. What is different is release management: why delta updates balloon under per-build renaming, and why signing the payload matters more than obscuring it.

Read article ›

Honest limits · New 2026-08-14 ~9 min read

Obfuscation will not fix a client-side vulnerability

Renaming changes how a program reads; a vulnerability is what it does with untrusted input. Why XSS, prototype pollution and request forgery are unaffected, and how protection can quietly silence your own scanners.

Read article ›

Runtime defense · New 2026-08-14 ~8 min read

Can you geo-restrict JavaScript in the browser?

No, and the reason is worth more than the feature: time zone and locale are settings, geolocation needs permission, and the IP address is only visible to your server. What the locks that do exist actually assert.

Read article ›

Architecture · New 2026-08-14 ~8 min read

Your AI system prompt is in your bundle

The prompt, the tool definitions, the model routing and the guardrail list all ship to the browser. Why encrypting strings is friction rather than confidentiality, and what belongs server-side instead.

Read article ›

Browser Security · New 2026-08-14 ~8 min read

Does obfuscation break Trusted Types?

Trusted Types closes DOM injection sinks, and protected output passes through enforcement cleanly with one narrow exception. Which two options emit an eval, and why the injected runtime modules are sink-free.

Read article ›

Third-Party Risk · New 2026-08-14 ~9 min read

Obfuscation, tag managers and the scripts you do not control

The APIs analytics vendors wrap are almost exactly the APIs the anti-tamper guard watches, so your own marketing tags trip it. The default watch list in full, and what the script inventory detects.

Read article ›

API Security · New 2026-08-14 ~9 min read

Obfuscation will not hide your GraphQL API

The query documents your client sends are protocol, not code style, so they travel in plain text however the bundle looks. What protection genuinely covers, which server-side controls do the work, and the member-renaming rule that keeps response handling intact.

Read article ›

Build Strategy · New 2026-08-14 ~9 min read

Obfuscating a multi-tenant SaaS frontend: one build or one per tenant?

Per-tenant builds cost shared caching, a multiplied release matrix and per-build report retention, and buy distinguishability rather than protection. The three cases where they are genuinely right, and where tenant isolation actually lives.

Read article ›

Supply Chain · New 2026-08-14 ~9 min read

Does obfuscation break your SBOM?

A lockfile-derived bill of materials is untouched by protection. An artifact scanner is broken completely by it — and so is any vulnerability scan pointed at the shipped bundle. How to tell which kind you have, and where each step belongs.

Read article ›

Media · New 2026-08-14 ~10 min read

Can obfuscating your player stop video piracy?

Under Encrypted Media Extensions the key never reaches page script, so there is nothing in the player to hide. What streaming client code is genuinely worth protecting, and which controls actually move the number.

Read article ›

Workflow · New 2026-08-14 ~9 min read

Should you obfuscate during development?

No — and the Vite and Next.js integrations already default to skipping it. But a protected build nobody has run until release day is the other failure mode. The four-tier arrangement that fixes both.

Read article ›

Delivery · New 2026-08-14 ~10 min read

When your CDN rewrites your protected JavaScript

Protection is meant to be the last transformation — but CDN minifiers, script loaders and hosting plugins quietly add another one after the build. What breaks first, and the ten-minute digest check that names the culprit.

Read article ›

Realtime · New 2026-08-14 ~9 min read

Your WebSocket protocol is in your bundle

Realtime clients ship the protocol and the frames are readable in DevTools regardless of the build step. Why every message needs server-side authorization, what protection genuinely covers, and why WebSocket sits on the anti-tamper watch list.

Read article ›

Node.js · New 2026-08-14 ~8 min read

Compiling Node.js to a binary is not obfuscation

Single-executable builds embed your JavaScript as text and bytecode keeps the whole constant pool, so string literals and property names survive. What each tool removes, and the order to run packaging and protection.

Read article ›

Client-side data · New 2026-08-14 ~8 min read

Obfuscation does not protect what you store in the browser

Protecting the code changes nothing about the values it writes. Why localStorage, IndexedDB and the Cache API stay readable, why encrypting in client code moves the problem, and what belongs in browser storage.

Read article ›

Web security · New 2026-08-14 ~8 min read

Can someone put your protected app in an iframe?

Domain locking does not stop framing, because inside a frame your document still reports your own hostname. What frame-ancestors actually does, and the delivery contexts where an empty hostname fires the guard.

Read article ›

Authentication · New 2026-08-14 ~8 min read

Obfuscation, passkeys and WebAuthn

A passkey private key never enters your JavaScript, so obfuscating the ceremony protects no credential. What is actually worth protecting in an authentication bundle, and why password managers trip the tamper guard.

Read article ›

Security & Risk · New 2026-08-14 ~8 min read

Obfuscation does not stop an insider — and what actually does

A contractor with a repository clone holds the input to your build, not the output — comments, history and all. Where the boundary actually sits, the one thing in the toolchain that helps after a leak, and the controls that do the real work.

Read article ›

Legal & Compliance · New 2026-08-14 ~8 min read

Obfuscation and trade secrets: does it help your legal case?

Trade-secret protection asks what reasonable measures you took — and a bundle sent to every visitor is a steep hill. Which logic to move server-side, what a protection run contributes as dated evidence, and where the argument stops.

Read article ›

Supply Chain · New 2026-08-14 ~7 min read

Obfuscation will not stop a malicious dependency

Obfuscation defends the outbound direction. A poisoned package travels inbound and is in your bundle before protection runs — where the transforms hide it from your reviewers as well as from everyone else. The pipeline order that fixes it.

Read article ›

Architecture · New 2026-08-14 ~8 min read

Obfuscating micro frontends and module federation

A host and a remote are separate builds, so they never share a generated mapping. What is actually on the cross-build contract, why member renaming is the sharp edge, and the report-per-remote trap that surfaces after the first production incident.

Read article ›

Runtime Integrity · New 2026-08-14 ~8 min read

Can you stop browser extensions modifying your site?

No — an extension runs earlier and with more privilege than your page. But per-build polymorphic output breaks a targeted userscript on every release, which is better attrition than any detection feature. Why the right response is to degrade, not block.

Read article ›

Compatibility · New 2026-08-14 ~8 min read

Does obfuscation break accessibility?

The transforms cannot touch the accessibility tree — ARIA, roles and label strings all survive. The risk is two runtime-defense options: one suppresses the context menu for everyone, the other mistakes an accessibility overlay for an attacker.

Read article ›

Product & Risk · New 2026-08-14 ~8 min read

Your JavaScript bundle is leaking your roadmap

Feature flags ship the code weeks before the announcement, and a thirty-second search of your production bundle returns flag names, unreleased endpoints and UI copy — in your own vocabulary. What raises the cost, and what only server-side evaluation removes.

Read article ›

Architecture · New 2026-08-14 ~8 min read

Should you compile to WebAssembly instead of obfuscating JavaScript?

It does make an algorithm harder to read. It also leaves your strings in a readable data section, your exports named, and your JavaScript glue in plain sight — so the license check you moved there is no harder to bypass.

Read article ›

Commercial · New 2026-08-14 ~8 min read

Source code escrow and due diligence when your JavaScript is obfuscated

Escrow holds source; obfuscation is a build step, so they only conflict when someone deposits the wrong artifact. Plus the seeded rebuild that lets a verification agent prove the deposit really produces the shipped files.

Read article ›

Build & Delivery · New 2026-08-14 ~8 min read

Testing obfuscated JavaScript: where protection belongs in your pipeline

Unit tests belong before protection and end-to-end tests belong after it — and a green pipeline that never executed the shipped bytes is the failure nobody notices. The assertions that break, and why snapshots need a seed.

Read article ›

Security Review · New 2026-08-14 ~8 min read

Your security scan flagged obfuscated JavaScript. Now what?

Three findings wear the same words: an informational note, “we could not assess this”, and a genuine CWE-656 design problem. Read which one you got before writing a word — then close it with evidence.

Read article ›

Threat Model · New 2026-08-14 ~8 min read

Can you disable DevTools and View Source?

No, and the reason tells you which alternatives are worth switching on. What debug protection, key blocking and self-defending output actually do, what they cost in support tickets, and the three things that genuinely work.

Read article ›

Threat Model · New 2026-08-14 ~8 min read

Does obfuscation stop web scrapers?

A scraper reads your responses, not your source, and a headless browser runs protected code exactly as a real one does. There is one case where obfuscation is decisive — a request signature computed on the client — and it is the case worth spending on.

Read article ›

Deployment · New 2026-08-14 ~8 min read

Obfuscation and long-term caching

Polymorphic output means unchanged source ships changed bytes, so every content hash moves and every returning visitor downloads everything again. Why pinning a seed forever is the wrong fix, and the per-release pattern that keeps both properties.

Read article ›

Engineering · New 2026-08-14 ~8 min read

Obfuscating JavaScript in a monorepo

Protect the deployable, not the package. Why protecting an internal library double-processes your code, why there is no shared identifier map across runs, and how polymorphic output turns a task-runner cache into a permanent miss.

Read article ›

Engineering · New 2026-08-10 ~7 min read

Does obfuscation break code splitting and dynamic imports?

Three concrete mistakes cause almost every broken lazy chunk: protecting chunks in separate passes, renaming files the bundler runtime looks up, and transforming strings the loader still reads. Each has a direct fix.

Read article ›

Deployment · New 2026-08-10 ~7 min read

Obfuscation and Subresource Integrity

SRI verifies bytes and protection changes bytes, so ordering decides whether your script runs at all. Hash last, know why polymorphic output churns every hash, and use a seed when something downstream needs a stable one.

Read article ›

Correctness · New 2026-08-10 ~8 min read

Obfuscating web components: the names the browser calls

The platform invokes connectedCallback by name and reads your options-object keys by name, and neither shows up as a caller in your source. Which names are contracts, and what is still safely protectable.

Read article ›

Engineering · New 2026-08-03 ~7 min read

Does obfuscation break Web Workers and Service Workers?

A worker is a second entry point with its own global scope and no DOM. Here is what that changes about which transforms are safe, why postMessage keys are a contract, and how to test it in ten minutes.

Read article ›

Engineering · New 2026-08-03 ~7 min read

Minify before or after obfuscation?

Bundle, minify, then protect — protection runs last. The two wrong orders fail differently, and one of them silently costs you tree shaking while looking perfectly fine.

Read article ›

Threat model · New 2026-08-03 ~8 min read

Can browser DevTools deobfuscate your JavaScript?

Pretty-print is a formatter and reverses nothing that matters. The debugger is the real capability. An honest account of what an analyst gets from each, and the one mistake that undoes everything.

Read article ›

Distribution · New 2026-08-03 ~8 min read

Should you obfuscate an npm package you publish?

Usually not — a published package is an input to someone else’s build, so you break their tree shaking and your own support workflow. The four cases where it is still right.

Read article ›

Performance · New 2026-08-02 ~8 min read

How much bigger does obfuscation make your bundle?

We measured 42 real libraries. Raw output roughly doubles, while the compressed bytes users download grow much less. See the full results, the outliers, and why already-minified input behaves differently.

Read article ›

Engineering · New 2026-08-02 ~7 min read

The newline rules that break JavaScript obfuscators

Five restricted productions make a line break change program meaning. These cases can produce valid output with silently wrong values, so they belong in every rewriting tool’s compatibility suite.

Read article ›

Correctness · New 2026-08-02 ~7 min read

Does obfuscation preserve “use strict”?

String tables and wrappers can quietly demote a directive prologue. Here is what changes when strict mode is lost and a small runtime probe that verifies the protected result.

Read article ›

Engineering · New 2026-08-02 ~6 min read

Obfuscating ES modules: what changes without a bundler

Export names are a public contract, not safe rename targets. Learn what remains protectable behind that module boundary and how to verify that protected .mjs files still link.

Read article ›

Fundamentals · New 2026-07-27 ~8 min read

JavaScript obfuscation techniques explained

Obfuscation is not one thing — it is a stack of transforms with different costs. Identifier renaming, string arrays, encoding and encryption, cross-file member renaming, control-flow flattening, and bytecode virtualization: what each removes, what it costs at runtime, and where to apply it.

Read article ›

Troubleshooting · New 2026-07-27 ~7 min read

Obfuscated JavaScript not working? The six causes, in order

It ran before protection and breaks after it. Nearly always one of six things — and the first one, a name matched as a string at runtime, accounts for most of them. How to find which, bisect the transforms, and build a repro worth sending.

Read article ›

Operations · New 2026-07-27 ~6 min read

How to debug obfuscated JavaScript in production

Don’t ship the source map. Keep each build’s identifier map private, translate field stack traces locally with jso-symbolicate, and run captured Sentry or Datadog events through the matching adapter — no upload, no key in the browser.

Read article ›

Source handling · New 2026-07-27 ~6 min read

Is it safe to use an online JavaScript obfuscator?

A textarea is not a sandbox — pasting is uploading. The ten-second Network-tab test that settles it for any vendor, the questions a security reviewer will ask you, and when to move to CI or a local workflow instead.

Read article ›

Design guidance · New 2026-07-27 ~7 min read

How to protect a JavaScript licence or trial check

One boolean stands between your paid product and a free one. Move authority to the server, virtualize the validation path, stop concentrating the decision in a single flag, and instrument tampering so a bypass surfaces in a week rather than never.

Read article ›

Legal & Licensing · New 2026-07-21 ~5 min read

Is JavaScript obfuscation legal?

Yes — obfuscating code you own or are licensed to modify is legal and routine. The real constraints aren’t obfuscation itself: honor third-party and copyleft (GPL) license terms, respect publishing rules (browser-extension stores forbid it), and remember obfuscation never launders illegal behavior.

Read article ›

Fundamentals · New 2026-07-21 ~5 min read

Obfuscation vs encryption: what’s the difference?

Not the same thing. Encryption needs a key to run and is reversible with it; obfuscation runs directly and only raises the cost of understanding. Anything that “encrypts” client-side JavaScript must ship the key to the browser — so it’s really obfuscation with extra steps.

Read article ›

Deployment hygiene · New 2026-07-21 ~6 min read

Why does obfuscated JavaScript trigger antivirus false positives?

Because malware pioneered the same techniques — string arrays, eval loaders, packed blobs — so heuristics fire on the shape, not the intent. How to ship protected code that doesn’t get quarantined: avoid eval, serve external files, sign your builds, keep behavior transparent.

Read article ›

SEO · New 2026-07-19 ~5 min read

Does obfuscating JavaScript hurt your SEO?

No — Google indexes the rendered page, not your source, so behavior-preserving obfuscation is SEO-neutral. The real rules: keep JSON-LD structured data readable (it’s data, not code), don’t bloat the bundle (Core Web Vitals), don’t block your JS from crawlers, and verify the rendered DOM is unchanged.

Read article ›

Security engineering · New 2026-07-19 ~5 min read

Does obfuscation break Content Security Policy?

Old eval-based packers break strict CSP; modern obfuscation doesn’t. String decoding, control-flow flattening, and VM bytecode are ordinary code — no eval, no new Function — so protected output runs under a strict CSP without unsafe-eval. Serve it as an external file and keep your policy strict.

Read article ›

Engineering · New 2026-07-27 ~7 min read

How to verify an obfuscator didn’t silently break your JavaScript

Output that parses is not output that works. Arrow functions lose their this, a unary minus fuses into a decrement, a tagged template stops calling its tag — all valid syntax, all wrong answers. A four-rung verification ladder, what each rung can and cannot see, and why diffing against the original beats testing against expectations you wrote yourself.

Read article ›

Performance · New 2026-07-19 ~5 min read

Does JavaScript obfuscation slow down your app?

A little, and it’s controllable. Identifier renaming is essentially free; VM bytecode is meaningfully slower by design. The whole game is matching transform strength to hot vs cold paths — protect the once-per-session license check hard, keep the per-frame loop light, and the cost disappears where it matters.

Read article ›

Threat modeling · New 2026-07-19 ~5 min read

Is JavaScript obfuscation reversible?

Yes, in principle — obfuscation isn’t encryption, and code that runs can be understood. But that’s the wrong question. What it actually does is raise the cost of reversing; the goal is to price the attacker you have out of reach. The reversal-cost spectrum, where AI/deobfuscators fit, and why measurable resistance beats an “irreversible” claim.

Read article ›

Threat modeling · New 2026-07-19 ~5 min read

You can’t hide an API key in JavaScript

A secret shipped to the browser is already public — the browser has to read it, so anyone can. Obfuscation raises the cost of finding a client-side key but can’t make it secret. What actually works (keep it server-side), the NEXT_PUBLIC_ trap, and where obfuscation genuinely helps: your logic, not your secrets.

Read article ›

Deployment hygiene · New 2026-07-19 ~5 min read

Your source maps are publishing your source code

A .js.map maps your shipped bundle back to original names — and with inlineSources, the original source text. Ship one beside a protected bundle and you have published exactly what you protected. How to check what you serve right now, why it keeps happening by default, and the one-line deploy fix.

Read article ›

Supply-chain integrity · Shipped 2026-05-28 ~7 min read

Watermarks + signed attestations for protected JavaScript

HMAC-SHA256 watermarks that survive every obfuscation transform, Ed25519-signed release attestations with two-stage verify, pre-flight quota gates, bulk forensic scanner. Cross-language verified across Node, Python, and .NET. Wire format is open. Six lines of GitHub Action YAML covers the whole stack.

Read article ›

JSO AI · Phase 1 shipped Updated 2026-06-06 ~5 min read

JSO AI previews and BYO keys are live

Four endpoints, three browser previews, encrypted OpenAI / Claude account keys, Prometheus usage export, JSON Schema, language client snippets, and RSS. Preview mode works without a key; BYO keys turn the same endpoints into live AI for that account.

Read article ›

Maximum Mode · VM Bytecode Beta Updated 2026-06-06 ~8 min read

VM-based protection for selected sensitive functions

Eligible Corporate+ accounts can test bytecode virtualization for small pieces of high-value JavaScript. The design tradeoffs and why it is opt-in per function rather than whole-bundle default.

Read article ›

AI-Aware Research 2026-05-20 ~10 min read

CASCADE and the LLM-deobfuscator question

Google’s CASCADE pairs Gemini with a JavaScript IR to deobfuscate at scale. What the paper actually does, where per-build polymorphism alone falls short against prelude-detection, and what’s on the JSO roadmap to answer it.

Read article ›

Resistance Score · Planned 2026-05-20 ~8 min read

The Resistance Score: planned evidence for AI-resistance claims

Every obfuscator markets “AI-resistant,” almost none ship a way to check it. The artifact JSO is designing to make the claim reviewable: a named adversarial probe, a source-free report, and recovery categories.

Read article ›

AI-Aware Research 2026-04-25 ~9 min read

Can ChatGPT, Claude, or Copilot reverse-engineer obfuscated JavaScript?

A direct technical answer for 2026. What today’s AI assistants can actually deobfuscate, where they break down structurally, and why per-build polymorphic decoders disrupt the pattern-matching approach LLMs rely on.

Read article ›

Vendor Analysis 2026-04-26 ~10 min read

JavaScript VM protection compared: Jscrambler, JSDefender, Verimatrix, OSS virtualizers

Vendor-by-vendor analysis of JavaScript bytecode VM protection — what each product actually ships, how the open-source virtualizers compare, and where selective virtualization fits against whole-bundle approaches.

Read article ›

Runtime Boundaries · New 2026-08-15 ~10 min read

Should you obfuscate an edge function?

Code that never reaches a browser has a different adversary. Which runtime guards fail closed with no DOM, why the evaluation-based wrappers are skipped for module source, and the one case where the answer is yes.

Read article ›

What Ships With Your Code · New 2026-08-15 ~10 min read

Your pricing logic is in your bundle

Discount tiers and eligibility rules computed in the browser fail twice: they disclose how you price, and they let the customer choose the number. What protection helps with and what it cannot touch.

Read article ›

Build Pipeline Hygiene · New 2026-08-15 ~9 min read

Keeping open-source license notices in a protected build

Permissive licenses ask you to preserve attribution notices in what you distribute, and comment removal deletes them. Only the run of comments above the first statement survives, which decides the whole strategy.

Read article ›

Where Authority Lives · New 2026-08-15 ~9 min read

Your JavaScript cannot authenticate a payment

Strong customer authentication is a claim about who verified the payer, and a browser is not in a position to make it. Why dynamic linking belongs where the amount is authoritative, and where the checkout risk actually sits.

Read article ›