What's New

The latest Code Integrity release builds on Jscrambler’s LLM-resilience foundation with code-hardening improvements that broaden protection coverage, ensuring stronger defense against AI-driven reverse engineering.

Key highlights:

– Research-Backed Anti-AI Defense: Countermeasures engineered after benchmarking leading AI models against real-world deobfuscation strategies.
– Seamless Protection Upgrades: Our core protections and standard templates have been directly enhanced with LLM-resilient techniques. You get stronger security across your existing protections, with no additional settings to reconfigure.
– Dynamic & Runtime Protections: Continuous runtime integrity checks, dynamic execution, and deceptive mechanisms designed to break static AI parsing and deplete attacker resources.
– Dashboard Transparency: Look for the new AI-resistance notice in your Code Integrity dashboard after applying the obfuscation transformations.

What’s included in the Code Integrity 8.6 version:
– Integration of Code Integrity into Jscrambler’s unified authentication platform (Dec 2025)
– Anti-Monkey Patching 2.0 (April 2026)
– Notifications: Dashboard views (live faults and reports) now include protection ID and custom labels, with filters on reports. The same fields are available in payloads sent to webhooks, SIEM, and other integrations. (April 2026)
– Hardening against LLM de-obfuscation (August 2026)

The AI Assistant is now fully released as part of Webpage Integrity 7.9, helping teams streamline PCI DSS compliance by understanding, analyzing, and making informed authorization decisions for every script running on payment pages.

The AI Assistant provides:
– Risk-Based AI Insights and Actionable Recommendations: Quickly, confidently, and securely approve scripts, onboard new vendors, and adapt to payment ecosystem changes with clear insights and intelligent recommendations (approve, block, restrict).
– Audit-Ready Instant Justifications: Instantly generate justification text with AI assistance to expedite PCI DSS compliance and reduce overhead.
– Interactive AI Chat: Access Jscrambler’s foundational expertise, get answers to questions on the fly, and support intelligent, confident business decisions with an AI chat assistant.

The AI Assistant is an opt-in feature. Also included in Webpage Integrity 7.9, PCI DSS exports can now be scoped and customized, resulting in faster, audit-ready exports. As part of this update, exports now include:
– Time-based export filters: default last 30 days, with predefined ranges available.
– Dataset scoping: export only relevant alerts, vendors, services, or headers.
– Field-level column selection: tailor exports to your specific audit needs.
– Broader coverage: across the alerts, vendor servicers, and HTTP headers dashboards.

Code Integrity 8.6 strengthens the security and stability of authentication by integrating Code Integrity into Jscrambler’s unified authentication platform.

With this release:
– Unified authentication platform: Code Integrity now runs on Jscrambler’s unified authentication infrastructure, consolidating how identity and access are managed across the platform.
– Stronger data security: Ensures Code Integrity meets and maintains the highest data security standards.
– Modernized infrastructure: Reduces technical debt and improves service stability across authentication flows.

You’ll benefit from enhanced security and stability immediately — no configuration or action required on your side. Your protection remains fully operational throughout and after the update.

Code Watermarking is a feature that empowers enterprises to take ownership of their JavaScript by embedding persistent, tamper-resistant watermarks into protected code, helping teams verify code ownership, deter IP theft, and trace leaks without relying on support tickets. Think of it as adding a digital signature to your code, making it instantly identifiable and defensible. With a user-friendly UI, you can upload a suspect JavaScript file or paste a URL to quickly check for embedded watermarks. The tool confirms ownership with a clear result:
– “Code belongs to [Organization], protected on [Date]”, or
– “No watermark match found.”

The benefits of Code Watermarking:
– Ownership Verification: Instantly confirm if questionable JavaScript originated from your team.
– IP Theft Deterrence: Persistent watermarks signal ownership, discouraging code misuse.
– Legal Evidence: Gain signature-like proof for IP or legal disputes.
– Forensic Tracing: Pinpoint the origin of leaked code during investigations.
– Enhanced Protection: Ensure your code isn’t reused without permission.
– Increased Awareness: Help your team recognize watermarking as a best practice for secure development.

Jscrambler launches Iframe Integrity, a new solution that lets payment service providers (PSPs) deliver instant PCI DSS v4-compliant payment iframes to merchants — protecting against script-based skimming attacks while meeting the new SAQ A and FAQ 1588 eligibility criteria.

Iframe Integrity features include:
– PSP Script Hardening: Tamper-resistant protection for PSP scripts against reverse engineering and automated threats.
– Function Hijacking Protection: Monkey-patching protection on privileged functions on the parent page.
– Iframe Hijacking Protection: Isolates the DOM methods attackers use to tamper with iframe creation on the parent page.
– Iframe Overlay Protection: Isolates the DOM methods used to create new iframes or tamper with existing ones on the parent page.
– Form Overlay Protection: Isolates the DOM methods used to create new forms or tamper with existing ones on the parent page.
– Iframe & Form Control: Fine-grained control over how scripts on the parent page can use iframes and forms.

Built on Jscrambler’s Code Integrity and Webpage Integrity technology, Iframe Integrity integrates directly into a PSP’s existing script build process — fully automated, continuously monitored, and requiring zero management from merchants. PSPs can deploy it now to meet SAQ A eligibility and give merchants provable protection against overlay, hijacking, and formjacking attacks on payment pages.

One-Click Code Protection is a feature that allows users to apply code protection in under 3 minutes without manual configuration. At the App Creation stage, users will be prompted to choose either Manual Configuration or Automatic Configuration.

It’s a convenient plug-and-play solution for code protection where you can apply a protection recipe that works on the first try, without having to delve into technical details or worry about fine-tuning or configuring transformations.

The benefits of One-Click Code Protection:
1. Simple to Use: The One-Click Code Protection feature is designed with user simplicity in mind, ensuring that anyone on the team can use it effortlessly. It enables users to safeguard their code with just a single click.
No Fine-Tuning Needed: One-Click Code Protection removes the need to select a template and/or manually fine-tune protection settings. Users do not need to worry about choosing the right protection strategy or adjusting parameters—everything is handled automatically.

2. High Level of Code Protection Resilience: The feature employs advanced algorithms and security mechanisms to offer a high level of resilience against reverse engineering and malicious JavaScript attacks. This guarantees that sensitive logic, intellectual property, and proprietary algorithms within the code remain well-protected, providing peace of mind for developers and stakeholders alike.

3. Time Efficiency: The entire process takes less than 3 minutes. There’s no need for manual configuration or tweaking, which allows developers to integrate security measures into their workflow without interrupting the pace of development. This quick protection process is especially valuable in fast-moving projects, where deadlines are tight and security is paramount.

4. Framework Compatibility: All the most popular hybrid mobile frameworks can be protected without manual configuration (React Native, Vue, React, Cordova, Ionic, NativeScript, etc.).

Jscrambler launches the PCI DSS Quick Start Program, giving merchants a fast, low-lift path to complying with PCI DSS v4 requirements 6.4.3 and 11.6.1 without tying up internal resources.

Quick Start Program benefits include:
– Payment Page Inventory Report (Prepare): Get a free, one-time Payment Page Analysis Report within 48 hours, inventorying every script on your payment page and flagging which ones access sensitive data or exfiltrate it to external domains — no commitment required.
– Unified Hybrid Architecture (Deploy): Start with agentless monitoring using just your payment page URLs — no website configuration needed — then layer in agent-based protection where you need direct control, all on Jscrambler’s WPI PCI DSS Hybrid Architecture.
– Automated Payment Page Compliance (Comply): Recurring script analysis, running 24/7 or every seven days, delivers the inventory, authorization, detection, monitoring, and alerting needed to satisfy Requirements 6.4.3 (script inventory, authorization, and integrity) and 11.6.1 (HTTP header and content integrity monitoring, with configurable alerts to email, SIEM, or Slack).
– QSA Payment Page Inventory Tool (Verify): Share a free inventory, authorization, and risk-level report directly with your QSA to speed up compliance verification, backed by Jscrambler’s QSA Alliance Program and partnerships with QSAs like Coalfire and Integrity360.
– Delegated Compliance (Manage): Offload manual script authorization to Jscrambler’s team under agreed-upon policies, cutting the hours your internal stakeholders spend on approval and compliance management each month.

Merchants get vendor-service-level script authorization (approving behaviors, not individual scripts), flexible agentless-to-agent deployment for scenarios like M&A, and the option to delegate compliance work entirely, all built on five years of Webpage Integrity anti-skimming experience.

Collaborative Workspace is a feature that allows multiple users to seamlessly work on the same app by inviting them to the Code Integrity dashboard under the same organization, providing a single, unified view across the whole team. One app project can now be accessed and protected by several users, with a full protection history and the ability to reuse a recipe from previous versions.

Key features include:
– Unified Interface: Several users can log into the Code Integrity dashboard and work collaboratively on protecting the same app.
– Real-Time Updates: Any changes made by a user are instantly reflected for all users, ensuring everyone is always working with the most current information.
– Version Tracking: A detailed history of changes lets users see who made each change and reuse a recipe from previous protections.
– Efficient User Management: Assign app projects to specific users and give them a specific role and permission.

Collaborative Workspace transforms how teams work together by providing a seamless, integrated environment for real-time collaboration on JavaScript protection, helping every team member contribute effectively and efficiently, boosting productivity and improving teamwork.

Jscrambler introduces Anti-Debugging as a standalone transformation in Code Integrity to replace the single mechanism previously bundled inside Self-Defending. This upgrade deploys nine distinct techniques to actively block reverse engineering, piracy, and malicious debugging. Unlike the old system, which only reacted after developer tools were closed, this new feature prevents attackers from debugging the code in real-time, masking event listeners, breakpoints, and fingerprinting defenses.

ECMAScript Compatibility update aligns our platform with modern ECMAScript specifications, ensuring full compatibility with the latest JavaScript syntax and coding patterns used by our customers. By supporting these advanced language features, developers can seamlessly protect their most efficient and organized code, directly helping our team close more deals and minimize customer churn.

The new Anti-Monkey Patching transformation within the Runtime Application Self-Protection (RASP) layer prevents unauthorized runtime modifications (monkey patching) of your application’s functions. This feature is accessible via both the UI and CLI and can be deployed in two configurations:

Automatic Mode: Automatically applies anti-monkey patching protection to all Global and Top-Level functions.

Targeted Mode: Limits protection to specific areas of your codebase, configurable via two methods:

– Code Annotations: Inline annotations placed directly above the code blocks you want to secure.

– Function List: A predefined list specifying the exact names of the Global or Top-Level functions to protect.

Advanced Configuration: When using Automatic Mode, you can use Code Annotations or the Function List to create exceptions. This allows monkey patching on specific, trusted functions where runtime modification is intended by design.
Available countermeasures: Custom Callback, Delete Cookies, Redirect, Real-Time Notifications, Data Exfiltration Prevention, Self-Destruct, and Break Application.

The upgraded Anti-Tampering feature delivers a more resilient, high-performance security layer designed to fit seamlessly into modern development workflows. By removing dependencies on dynamic code execution (such as eval or the Function constructor), the transformation ensures full compatibility with strict Content Security Policies (CSP) and complex frameworks like React Native Hermes. Unlike traditional single-technique methods that create obvious attack vectors, this update distributes discreet checks across multiple areas of the codebase to eliminate single points of failure, shield against code lifting, and allow you to deploy anti-tampering independently from anti-debugging controls.

This update significantly elevates both application security and the end-user experience. Apps leveraging the new Anti-Tampering transformation benefit from reduced file sizes and faster script load times, translating directly into a smoother, more responsive user experience. Furthermore, you gain complete flexibility over threat responses with an expanded suite of active countermeasures, including Custom Callbacks, Cookie Deletion, Redirects, Real-Time Notifications, Data Exfiltration Prevention, Self-Destruct, and Break Application, allowing you to tailor your defensive posture to any runtime threat.

The central theme of Jscrambler 8.0 is a massive leap forward in anti-reverse engineering capabilities, headlined by the introduction of our groundbreaking VM-Based Obfuscation alongside enhanced AWS compatibility. This milestone release also highlights powerful capabilities introduced in recent minor versions, including Memory Protection, Root/Jailbreak Detection, and Data Exfiltration Prevention. Rated as a high-potency, high-resilience transformation, VM-Based Obfuscation radically raises the barrier for attackers by shifting from traditional JavaScript obfuscation to a compiler-based approach that translates your source code into low-level binary machine code.

When applied strategically via Code Annotations, the feature embeds this binary payload inside a heavily obfuscated JavaScript wrapper file that acts as a secure, specialized Virtual Machine (VM) to interpret the code at runtime. Because reverse-engineering binary code requires an entirely different, highly specialized skill set compared to JavaScript, static analysis becomes exceptionally difficult. Furthermore, the compilation process is fully polymorphic, generating a completely unique binary architecture and “language” with every single build, ensuring that any progress an attacker makes is entirely neutralized on the next deployment.

Jscrambler 7.3 brings the major feature advancements from our 7.2 Stable version directly into the latest release cycle. This milestone introduces full compatibility with ECMAScript 2020 specifications, allowing development teams to seamlessly secure modern JavaScript syntax and coding patterns. Alongside this updated language support, the core highlight of version 7.3 is a massive optimization of our underlying code protection engine, engineered to eliminate deployment bottlenecks and significantly streamline development pipelines.

By implementing horizontal scalability across all deployments, Jscrambler has dramatically accelerated processing speeds, delivering protection times up to 5 times faster. This performance breakthrough is especially impactful for enterprise-grade applications and continuous integration (CI) workflows that manage large codebases with hundreds of files. With this upgrade, organizations can maintain an aggressive, high-potency security posture without introducing friction or overhead to their automated build and delivery pipelines.

Jscrambler 7.2 introduces powerful ecosystem integrations and advanced runtime defenses, headlined by native SIEM Integration and a new Data Exfiltration Prevention countermeasure. Building on our real-time JavaScript Threat Monitoring, the SIEM Integration allows enterprise clients to automatically forward and aggregate security violation logs, such as code tampering or environment lock breaches, directly into platforms like Splunk and Elasticsearch. By enriching existing security dashboards with Jscrambler’s real-time runtime insights, security teams can seamlessly centralize their audit logs, streamline security operations, and automate threat alerting within the monitoring tools they already use.

To further mitigate runtime threats, this release introduces a groundbreaking Data Exfiltration Prevention countermeasure alongside a ChromeOS environment lock and an optimized global built-in names obfuscator. When a tampering or debugging attempt triggers Jscrambler’s defenses, this new countermeasure instantly blocks the application from transmitting data to external networks or unauthorized third-party services. Working seamlessly across browsers, Node.js, and hybrid frameworks like React Native, this feature provides a critical layer of data protection that actively stops data leakage and secures sensitive user information the moment a breach is detected.

Jscrambler 7.1 introduces powerful new mobile security layers and enterprise management capabilities, headlined by native Jailbreak and Root Detection, Memory Protection, and Single Sign-On (SSO). Engineered to fortify mobile applications that handle highly sensitive client-side data, the new Jailbreak/Root Detection capability allows app owners to instantly identify if an iOS or Android device has been compromised with root or administrative privileges. By detecting these high-risk runtime environments, Jscrambler provides an essential line of defense against data exfiltration and advanced client-side tampering.

Operating similarly to Jscrambler’s existing application locks, this feature gives organizations full flexibility to define automated runtime responses when a compromised device is detected. App owners can deploy a vast array of flexible countermeasures, ranging from safely terminating the application session or disabling specific high-risk features to executing completely customized security actions. This ensures that sensitive mobile workloads remain protected and compliant, even when deployed on untrusted or hostile operating systems.

Jscrambler 7.0 extends its JavaScript protection technology to mobile apps, making it a one-stop shop for protecting both web and mobile applications from a single platform.

The main features and benefits include:
– Cross-platform mobile protection: Protect React Native, Ionic/Cordova, NativeScript, and PWA apps alongside your web JavaScript, with integrations thoroughly documented and tested for a seamless setup.
– App Classification: Upload your code to get an automatic analysis of its compatibility and frameworks, which Jscrambler uses to fine-tune protection to your specific app.
– Browser Compatibility: Set the specific browser versions you need to support, and Jscrambler helps ensure your selected transformations stay compatible with them.
– Improved Application Profiling: New profiling modes help you act on performance recommendations and integrate profiling into your CI/CD pipeline, with process management now available via CLI.

Jscrambler 6.0 introduces JavaScript Threat Monitoring, giving you real-time visibility into every attempt to debug, tamper with, or break a code lock in your protected code — backed by a new unified dashboard.

The main features and benefits include:
– JavaScript Threat Monitoring: Get notified whenever someone attempts to debug, tamper with, or break a code lock in your protected code — for example, every attempt to run browser-locked code outside the allowed browser.
– New Jscrambler dashboard: View threat statistics at a glance, categorized by type, location, IP, and timestamp, as a unified home for both Code Integrity and Webpage Integrity.
– Webpage monitoring: Set up and manage webpage monitoring to see threats to the client side of your application, including the specific injected code and its location.
– Stronger Application Shielding: New transformations and increased protection against specific reverse-engineering tools and techniques.

Jscrambler 3.x is being retired in Q1 2018, with all 3.x cloud users migrated to Jscrambler 5.1 — a substantial upgrade across transformations, compatibility, and the overall platform experience.

The main features and benefits include:
– New and improved transformations: Including Control Flow Flattening and a more resilient Self-Defending technique, with several transformations now working together for stronger protection.
– Targets: Choose exactly which JavaScript primitive types or expressions a transformation should apply to.
– ES2015 compatibility: Jscrambler is now fully compliant with the ES2015 spec.
– Fresh features: Randomization Seed, Source Maps, and more flexible Code Annotations join the platform.
– New Node CLI: Customize how your workflows interact with the Jscrambler API.
– Refreshed UI and App Dashboard: A revamped interface streamlines protection and project organization.

Migrating from 3.x requires converting your JSON configuration and reviewing Code Annotations; custom templates are migrated automatically, and default templates have been updated to reflect the new features.

Jscrambler 4.0 is a major breakthrough for JavaScript security, reworking the platform around application management while adding new transformations and finer control over how protection is applied.

The main features and benefits include:
– Untraceable protection: Transformations now work together so your code takes a distinct, newly obfuscated form on every run, leaving no consistent trace for attackers to study.
– 18 new transformations: Including full control-flow flattening and regular-expression hiding, adding to Jscrambler’s existing library of unique protection techniques.
– App-centric platform: Create, version, and manage web, mobile, and Node.js applications in one place, with clear visibility into how each version is protected and deployed.
– Side-to-Side comparison tool: Preview original and transformed code side by side, and choose exactly which targets (strings, classes, functions, and more) to transform in real time.
– Code annotation controls: Enable or disable transformations, change transformation parameters, or reorder transformations directly via code comments on the Ignore Code Blocks feature.

Jscrambler 3.8 gives you precise control over which public identifiers get renamed, making Rename All safe to use instead of settling for Rename Local.

The main features and benefits include:
– Unsafe Mode: Renames every identifier except those from HTML5/JS native APIs, regardless of whether they’re defined — maximum potency, with some risk of breaking undefined references.
– Safest Mode: Only renames identifiers whose definition is found in your source code, avoiding the errors that come with renaming undefined references.
– Include and Exclude Lists: Force specific identifiers to always be renamed (Include) or never be renamed (Exclude), regardless of which mode you’re using — giving you the final word if something breaks.
– Stronger obfuscation: Targeting more identifiers means more of your code’s meaning is stripped away, and those newly-targeted names are also caught by other transformations for a more resilient result.

Jscrambler 3.7 protects all the main JavaScript libraries and frameworks with the most compliant version of Jscrambler yet, and laying the groundwork for ECMAScript 6 support.

The main features and benefits include:
– Broader framework compliance: Jscrambler now handles edge cases across popular libraries and frameworks, including AngularJS custom HTML attributes (module and controller names) and RequireJS module loaders that require special transformation behavior.
– Automated compliance testing: A new automatic testing process continuously verifies compliance against current libraries and frameworks. Compliance test results are available for you to review, and you can submit your own or third-party libraries to be added to the test suite.
– ECMAScript 6 (Harmony) groundwork: Jscrambler introduces JavaScript strict mode compatibility and protection for Harmony generators, laying the foundation to support ES6 features as they roll out across major browsers.
– Atom editor integration: A new plugin lets you request obfuscation directly from GitHub’s Atom text editor, speeding up your protection workflow. (Note: this Atom package was deprecated in 2019.)
– Domain Lock and Expiration Date messaging: Communicate directly with your application’s users when protection stops it from running, whether due to an unauthorized domain or an expired subscription, improving the user experience and reducing support friction.