String encryption is not enough: attackers dump your JavaScript at runtime

String encryption hides literals in the file, not at runtime. This article explains how a runtime dump undoes string tables, why control-flow and VM protection raise the cost of finding when those strings are used, and why secrets still do not belong in client JavaScript.