Need: Code Protection

Jscrambler 101 – Anti-Debugging

Posted on July 24, 2026 by -

Welcome back to Jscrambler 101! A collection of tutorials on how to use Jscrambler to protect your JavaScript. This tutorial is about the Anti-Debugging transformation and covers Jscrambler version 8.3.

Introduction

We will explore Anti-Debugging, a new Jscrambler feature released in version 8.3. The Anti-Debugging feature protects your application by making it harder for attackers to debug an app by activating defenses that stop any reverse engineering attempts.

About Anti-Debugging

Before Anti-Debugging, Jscrambler offered an anti-debugging capability within the Self-Defending transformation. However, some concerns about more advanced reverse engineering and piracy ran deeper than this defense. Debugging with malicious intent, through, for example, bypassing the debugger with event listeners’ breakpoints, and then removing/disabling the fingerprinting or tampering with a license verification mechanism, was becoming a great concern. The Anti-Debugging feature was developed to make it increasingly harder for attackers to debug the code and commit fraud.

How does Anti-Debugging work?

This transformation uses several techniques to detect debugging activity. The user can define the countermeasures to be triggered if, during runtime, debugging activity is detected. When the code is protected with this transformation, checks are injected at the start of the program. Each check then runs three random techniques during runtime to detect debugging activity. Additionally, a different subset of techniques is used in each runtime to maximize the detection efficiency. Once detected, the countermeasures selected will be triggered.

Benefits of Anti-Debugging

With Anti-Debugging, there’s an opportunity to trust your environment more, making it easier to balance security and flexibility. It becomes increasingly more difficult for attackers to exploit dev tools designed to help your team debug to reverse engineer the code without being noticed. Key feature benefits include:
  • Enhanced detection – combining nine techniques heightens the ability to identify debugging activity. Each runtime uses a distinct subset of techniques, increasing the overall detection capabilities.
  • Stronger resilience – the injection of random checks in the source code reduces single points of failure, resulting in a more resilient defense against debugging activities.
  • Broader attack surface coverage – the diverse and independent nature of the techniques addresses various debugging approach strategies.
  • Extended defense protection – safeguarding against different types of breakpoints (conditional, exception, event, and XHR/fetch), offline debugging, and offering swift reactions upon detecting debugger activity.
  • Smooth and quick reaction – a wide array of countermeasures, such as custom callback, delete cookies, redirect, real-time notifications, data exfiltration prevention, self-destruct, and break application, provide an extensive defense toolkit. The option to stop or break application execution is discretionary.

Popular use cases

What are you protecting yourself against with Anti-Debugging? This is a great feature to shield from reverse engineering attempts that may have various forms of malicious intent:
  • Piracy
  • Licence abuse
  • Cheating and bypassing restrictions
 
—

Anti-Debugging

Self-Defending

FEATURES
Multiple Anti-Debugging Techniques YES NO
Detect Built-in Method Poisoning NO Limited
Stops the Event Loop NO YES
Anti-Debugging YES YES
Forces the Use of Anti-Debugging N/A YES
Allows breakpoint detection YES, if selected YES, always
Anti-Tampering NO YES
CSP: Requires unsafe-eval NO YES
Tolerate Minification YES Optional
Countermeasures: Disable Break Application YES NO
Countermeasures in General YES YES
Control with Annotations YES Limited

COMPATIBILITY
No Internet Needed YES YES
Modern Browsers YES YES
Internet Explorer NO/NOT TESTED YES
Node YES YES
React Native with Hermes YES NO
React Native YES YES
Other Mobile Frameworks YES YES

Conclusion

Anti-debugging is fully compatible with all major browsers and the browser’s Content-Security Policy (CSP), Node.js, and specific hybrid mobile frameworks, including Ionic, NativeScript, React Native, and React Native Hermes. Contrary to Anti-Tampering, it is possible to use both Self-Defending and Anti-Debugging, as the existing Self-Defending protection (against tampering and debugging) will remain available.  

MeDirect Protects its Source Code with Jscrambler

Posted on July 24, 2026 by -

MeDirect Protects its Source Code with Jscrambler
Code Integrity’s multi-layer protection significantly reduced the attack surface of MeDirect’s banking application, making it much harder for potential attackers to understand the logic behind the app.

Overview

MeDirect is a pan-European digital banking company founded in 2004 and Malta’s third-largest banking group in terms of total assets. MeDirect focuses on WealthTech and specialized mortgage lending. It offers different tools and services to help customers manage their money from over 850 funds, 400 ETFs, and 3,000 stocks. MeDirect has over 106,000 customers and is expanding globally. Their vision is to provide a convenient way for people to manage and control their finances.

Challenge

MeDirect was concerned about users accessing the code built with NativeScript. This represented a security risk as their source code could easily be reverse-engineered. MeDirect tried some obfuscation techniques to hide its code but quickly understood it wasn’t enough to ensure its security.

When choosing the best solution to protect their web application, MeDirect prioritized the ease of integration and the effectiveness of JavaScript protection. MeDirect was also worried about impacting the performance of their application – they wanted to guarantee that the new security solution would not have any performance impact.

Solution

MeDirect focused on the benefits of polymorphic JavaScript Obfuscation, which transforms source code into a new version that is extremely hard to understand and reverse engineer while keeping its original functionality. This security layer also includes Jscrambler’s Code Hardening feature, which provides up-to-date protection against all reverse-engineering tools and techniques.

MeDirect’s team conducted several tests to check the threat resistance level and security effectiveness, including Penetration Tests, Vulnerability Scanning, and Code Reviews. This set of mechanisms was used to measure the ability of the code to resist different types of threats, such as code injection, data theft, and unauthorized access.

“Jscrambler fulfilled the entire checklist of the application security worries we had.”
Chris Portelli

Chief Technology Officer at MeDirect

Top Jscrambler Features and Capabilities

  • Polymorphic JavaScript obfuscation
  • Code hardening and self-defensive capabilities against tampering attempts
  • Minimal impact on performance and file size optimization

Results

MeDirect’s team encountered no issues when implementing Jscrambler. They started with the base mobile template first and integrated Code Integrity in minutes as it slid easily into their CI/CD pipeline.

MeDirect had an extensive checklist of critical needs that Jscrambler managed to satisfy by providing in-depth protection of their app source code.

Strengthening Biometric Protection with Jscrambler & Build38

Posted on July 24, 2026 by -

Strengthening Biometric Protection with Jscrambler & Build38
Learn how Jscrambler and Build38 enabled a major KYC provider to expand its biometric authentication security from mobile app to web, providing users with a unified, frictionless, and highly secure experience across all devices.

Overview

A London-based identity verification provider and one of Europe’s leading biometric vendors partnered with Build38 and Jscrambler to deliver advanced, cross-platform protection against digital fraud. By securing their unique approach to passwordless authentication—which verifies users without storing any biometric data—they successfully mitigated the risk of unauthorized account access. This collaboration enabled the company to expand its biometric authentication security from mobile app to web, providing users with a unified, frictionless, and highly secure experience across all devices. Our provider delivers a passwordless, multi-factor authentication approach that relies on biometric verification while safeguarding user privacy by storing no biometric data. This solution helps mitigate unauthorized account access and streamlines secure authentication across various devices.

Challenge

The company had previously partnered with Build38 to protect its mobile SDK against video injection attacks, in line with CEN standards. It then sought to implement comparable safeguards for its web channel, where threats like synthetic or replayed video streams could undermine liveness verification mechanisms.

The organization detected two distinct attack vectors targeting its web SDK: crafted video injection and virtual camera bypass.

Solution

Having already trusted Build38 to secure its mobile SDK against video injection and reverse-engineering attacks, the team sought to extend the same certified level of protection to its web SDK

The objective was to create a unified, cross-platform defense that could withstand sophisticated fraud techniques while maintaining an effortless user experience. To achieve this, the company selected Jscrambler’s Code Integrity to shield its JavaScript code from runtime manipulation, DOM tampering, and reverse engineering.

Build38 and Jscrambler partnered on a proof-of-concept (PoC) during which real-world attack scenarios were simulated to evaluate the solution. To counter these threats, Jscrambler deployed its anti-DOM tampering and anti-monkey patching capabilities and Code Integrity protection features. The PoC focused on two primary objectives: performance and code security. The implementation needed to operate seamlessly, preserving the user experience while effectively defending the application against simulated attacks. Jscrambler’s library met both requirements, protecting the code without compromising speed, which ultimately led the organization to move forward with a full license.

“We jumped on a call with the Jscrambler team and got very good guidance about what we needed to do. It was easy to set up, easy to fine-tune when it needed fine-tuning, and that was it. Then we let it run”
Development Lead at the Identity Verification Platform

Top Jscrambler Features and Capabilities

  • Unified Client-Side Protection
  • Reliable-at-Scale Performance
  • Mitigation of SDK Security Risks

Results

By combining the strengths of Build38 and Jscrambler, the identity verification company achieved a comprehensive, end-to-end security solution. Build38 provides protection for the mobile application, while Jscrambler’s Code Integrity technology secures the web SDK with runtime protection, making it resilient to tampering.

By implementing Jscrambler, Marriott Vacations Worldwide achieved:

  • Evidence of Compliance
    Compliance with PCI DSS 6.4.3 & 11.6.1, ease of demonstrating/providing evidence of compliance
  • Full Client-Side Protection
    Platform leveraged by other internal teams outside of PCI Compliance
  • Visibility & Control
    Enhanced visibility & control over all payment pages across all brands
  • Improved Risk Posture
    Improved risk posture through real-time script monitoring and header integrity validation