Static transformation · execution quarantined
Read the program without running it.
Unknown JavaScript should not need permission to execute merely to become readable. DevSexy sends source through a parser, AST, and printer or minifier—never through an evaluator.
01
Source text
02
Babel parser
03
Abstract syntax tree
04
Printer or Terser
ExecutionNo route
No eval, import, Function constructor, DOM injection, or runtime side effects.
Syntax passport
Choose a parser that recognizes the document.
The Babel path covers modern JavaScript. Babel-Flow adds Flow annotations; selecting it does not type-check the program.
ES modules
export { load } from './api.js'Babel · FlowAsync / await
const value = await load()Babel · FlowOptional chaining
profile?.team?.nameBabel · FlowClass fields
class Store { ready = false }Babel · FlowTemplate / regex
`/users/$` · /a+b/giBabel · FlowFlow annotation
function f(value: string): numberFlow parserTwo exits from one parse
Readable source and delivery source solve different jobs.
Format
Reviewexport async function load(id) {
const response = await fetch(`/items/${id}`);
return response.json();
}- Names remain descriptive
- Comments and structure stay reviewable
- Whitespace is intentionally added
Minify
Shipexport async function load(t){const n=await fetch(`/items/${t}`);return n.json()}- Local names may be mangled
- Most comments are removed
- No source map is claimed or emitted
Minifier risk ledger
Compression has assumptions worth reviewing.
Direct evalString code can observe local namesAvoid or review mangling scope
Dynamic property accessQuoted runtime keys may be externally ownedDo not infer a property-mangle promise
License commentsLegal notices can require retentionOnly /*! comments are preserved here
Side effectsUnused-looking expressions may still actThis is not tree-shaking or bundling
Source mapsProduction debugging needs mapping artifactsGenerate them in the build pipeline
Parser incident report
A malformed token gets evidence, not execution.
Unexpected token · line 2
const user = { name: 'Ada' };
if (user?.name {
console.log(user.name);
}The condition opened with ( but reached { before ). Close the condition first; later locations may only be cascade errors.