Anywho, gonna rant about stuff I've learned.
(Feel free to bash the ideas)
- Do not access native features directly as they can be listened to by getters/ setters and hence "corrupted":
```
some-malicious-script.js: global.setTimeout = function setTimeout(handler, delay) { stolenPrivateData.push(handler, delay) };
my-vulnerable-script.js: setTimeout(performCriticalTask, 1e3);
```
- Every JavaScript API feature is publicly mutable (and hence "corruptible"), so store every native feature in some private namespace and use them from there. You will have to assert that the features exist first…