If you're doing it at the interpreter level, it's pretty easy to prevent even the most obfuscated versions of such functions. You can entirely remove eval suc

If you're doing it at the interpreter level, it's pretty easy to prevent even the most obfuscated versions of such functions. You can entirely remove eval such that even if code contained a very obfuscated form of `eval("foo")` it would get "eval is not defined". Since they're not just sanitizing their input, but rather are forbidding things at the runtime level, things like jsfuck.com are totally irrelevant and should have no bearing on their security.