Reverse once, run forever: designing client-side defenses that assume the attacker has already read every line

There's a sentence every engineer in this field eventually says out loud, usually with a sigh: "But the code is right there in their browser." It is. That's the whole problem, and pretending otherwise...