Forem: Thomas Betous

Cracking the code: How Copilot supercharged my last CTF and where it fell short

Thomas Betous — Mon, 30 Jun 2025 12:02:18 +0000

Over the years, I’ve always been drawn to riddles and brainteasers. It’s no surprise, then, that as a software engineer, I’ve always been interested in Capture The Flag (CTF) cybersecurity challenges. In these challenges, you need to find a solution (hack) to retrieve a secret string hidden somewhere. This could be in a website, social media, assembly code, images, or any medium that can conceal information. These challenges require a broad range of knowledge, particularly in computer science and software engineering, but also creativity and inventiveness. However, I never dared to try because, in my mind, CTFs were reserved for the elite: the seasoned hackers with skills far beyond my own.

Now, at 35, life is busier than ever. I recently became a father, and finding time for new pursuits feels almost impossible. But the itch to finally try a CTF remained. My main obstacles? A lack of time and the belief that I didn’t have enough knowledge.

That’s when generative AI, like ChatGPT, Gemini, Github Copilot sparked an idea: what if I tried hacking with AI as my sidekick? To my surprise, not only were CTF challenges more accessible than I’d imagined, but AI assistants also helped me save precious time by accelerating my learning and problem-solving. Thanks to this partnership, I completed the 404 CTF — one of France’s most famous competitions — and finished in a respectable 165th place out of more than 2,800 participants.

In this article, I’ll share how I used AI to supercharge my hacking journey, the tips I picked up along the way, and where the limits of AI became clear. As a disclaimer before diving in, while I used GitHub Copilot for this article, other technologies like Cursor, Claude, and similar tools are equally valid choices. You can even use several of them simultaneously, the end goal remains the same.

💬 Prompts I used the most and how I used them

Explain me the purpose of XXX?

GitHub Copilot is an excellent assistant that integrates seamlessly with VS Code. Microsoft’s plugin provides a powerful interface where you can query specific lines of code or use a dedicated console to focus Copilot’s attention on particular files or directories.

Since most CTF challenges begin with analyzing files, Copilot proved to be a perfect investigation tool. My typical workflow starts by asking Copilot to analyze the project, explain its purpose, and map out the function of each file. Then, I examine each file in detail, and whenever I encounter something unfamiliar, I ask Copilot to explain specific sections.

"Copilot, could you explain the purpose of this project? Could you describe the function of each file and directory?" — prompt example

For instance, one web security challenge included an nginx configuration file. While I don't regularly work with nginx configurations, by asking Copilot to explain specific instructions, I could quickly understand their purpose without leaving VS Code. This allowed me to learn just enough to efficiently identify potential attack vectors.

An important consideration is that files aren't always immediately readable by Copilot (or any AI assistant). Sometimes you need to be creative with file formatting. For example, when challenges provide binary files, Copilot can't interpret them directly. The solution is to export the binary's hexadecimal or assembly code to a text file. This conversion makes the content accessible to Copilot for analysis. While this approach is valuable for initial investigation, sometime specialized tools are necessary for deeper analysis. In my last example, after the initial examination with Copilot, I had to switch to BinaryNinja for a more thorough investigation of the binary file.

Another interesting example involves analyzing a pcapng file containing network captures. The challenge was to discover how a malicious user extracted a password from numerous network packets. While this file wasn't readable in VS Code and required Wireshark for viewing, it contained an overwhelming amount of data, including many irrelevant packets. To effectively analyze such data with an AI assistant, you first need to filter out the relevant packets (in my case, HTTP packets) through Wireshark and then export them to a more comprehensible format like JSON. It's essential to perform this initial filtering step, as otherwise, the AI assistant won't be able to analyze the data effectively due to the sheer volume of information.

Do you see any security issues or unusual elements?

After analyzing the structure of a challenge, there are times when I don't immediately spot relevant issues. In such scenarios, I ask Copilot to identify potential security vulnerabilities. Often, Copilot suggests multiple issues that provide a good foundation for starting to hack. This is where your skills as a hacker/developer become crucial, you need to evaluate and filter these suggestions, identifying which are viable and which aren't. You also need to find synergies and discover exploits that Copilot didn't explicitly mention. Frequently, challenges require exploiting multiple security vulnerabilities in combination rather than just a single issue.

"Copilot, do you see any security issue or unusual elements in route.py? Do you see any deprecated dependencies?" — prompt example

For example, in one web security challenge from the 404CTF, solving it required combining multiple vulnerabilities that Copilot helped identify such as issues in both the backend and proxy cache server. Out of the various potential problems Copilot pointed out, I had to analyze, select, and connect the relevant ones to reach the solution and extract the flag. This experience shows how AI can accelerate the investigative process, but still requires human intuition to piece everything together.

Finally, when Copilot identifies vulnerabilities, the method of exploitation isn't always obvious. You can continue the conversation with your AI assistant by asking how to exploit these vulnerabilities and requesting more detailed information. Don't hesitate to ask about specific tools or request step-by-step instructions for executing your hack. Those questions are always instructive and provides valuable learning opportunities.

"Copilot, what's a smuggle request and how can I do it ? Can you guide me step-by-step?" — prompt example

Write a Python script to accomplish XXX?

The analysis process generates numerous ideas. Generally, these ideas require some coding to create a proof of concept for a vulnerability. When you're unsure where to start and time is limited, asking an AI to write a small code snippet can be valuable. Copilot can adapt to your repository structure and generate files in the appropriate locations with the requested code. While not essential, this approach saves time.

One crucial point to notice is that you need to be precise with your requirements; otherwise, the generated code may not align with your needs. Don't hesitate to specify the programming language, preferred libraries, and your desired outcome. The goal isn't to obtain perfect code, but rather to get something you can easily customize to suit your specific needs.

"Copilot, can you write a Python script with pwntools that connects to [IP] and [PORT], receives two numbers, adds them, and sends back the result." — prompt example

🔄 It's an iterative process

This process is often iterative. Basically, after the global analysis, I enter a loop where I filter the data I have, analyze it, ask questions, inquire about security issues, and reflect on the results. Then, I reiterate again and again until I start to assemble pieces of the puzzle to solve the challenge.

💔 What's the drawback of using AI for a CTF

Using AI is exhausting

Using AI allows me to learn quickly, but it's exhausting. While you can access specific information and documentation faster than ever, it involves processing a lot of knowledge in a short time. You need to read extensively, maintain focus, and review every suggestion and generated code snippet. It's a different style of work. Counter-intuitively, working with an AI assistant actually consumes more energy than working alone. While one might think that having a computer do the thinking would require less effort, the reality is quite different.

Working without an AI assistant is a steady hike; working with one is a sprint - you move faster, but it takes a lot more energy.

AI == cheat?

A legitimate question might be: is using AI cheating in a CTF? For the easiest challenges, like the Intro or Easy levels in 404CTF, AI can sometimes hand you the solution on a silver platter. But as soon as you move up to Medium or harder, the problems get too complex for Copilot or any AI to just solve for you.

That's why I don't see AI as a cheat code. In reality, it's just one tool among many, like the ones real hackers use to break systems in the wild. Sometimes it helps, sometimes it doesn't, and it rarely cracks the tough challenges on its own. In cybersecurity, there are no shortcuts, just different methods and tools to reach your goal. And honestly, no hacker would refuse a useful tool just because it feels "unfair."

AI mostly raises the floor, not the ceiling. It helps beginners level up faster, but expert won't suddenly become stronger thanks to AI alone.

AI can be censored for certain types of questions

Sometimes I encountered limitations with Copilot, likely due to ethical considerations. When attempting to create attacks, Copilot sometimes refuses to provide assistance. As a workaround, I needed to specify in my initial prompt that I was working in a CTF context. However, even with this clarification, Copilot might still censor certain responses.

It's amusing to realize that you sometimes have to find creative ways to "hack" Copilot itself. It reminds me of Asimov's novels, where clever loopholes are found in the famous three laws of robotics. In a similar way, you need to think outside the box to get Copilot to do what you want.

AI can push you to do some unsecure actions

While asking Copilot how to exploit vulnerabilities, I sometimes received recommendations for tools whose safety I wasn't entirely confident about. When investigating these tools on GitHub, regardless of their quality, they often had few stars, indicating limited usage, and were frequently unmaintained with commits dating back years. This didn't inspire much confidence.

For example, when I was looking for a password generator based on social knowledge, Copilot recommended tools like pypasswords. While I won't judge this tool's quality, it may be good but pypasswords' last commit was 5 years ago and the project only had 1 star. Without looking in more details, it can be dangerous to install such a library.

That's why, as personal advice, I recommend not blindly trusting what your AI suggests when it comes to running commands or installing libraries. Always verify what you're about to execute.

AI can lead you down the wrong path

I think it's part of the experience, but I've lost count of the times Copilot has hallucinated issues where there were none, or assured me everything was fine when there was actually a subtle problem. I once spent hours trying to craft a smuggling request that turned out to be impossible - simply because Copilot suggested it might work. But as I mentioned earlier, this is a valuable lesson: don't blindly trust everything your AI suggests.

That said, I'd put this into perspective based on your goals with CTFs. If your aim is to learn new skills, sometimes following the wrong leads can be incredibly educational.

🚀 Beyond the CTF

Using AI to solve CTFs is fun, and I strongly encourage you to try it. You'll sharpen your AI skills for analysis and programming while learning extensively about specific domains. Personally, I focused mainly on web security since I specialize in web development. The knowledge I gained is valuable and helps me spot issues I might have missed before. It's all about honing your skills.

At Doctolib, we actively encourage software engineers to embrace AI, not to work less, but to free up time for higher-value tasks that truly matter. This philosophy mirrors exactly what I experienced during my CTF journey.

Just as I used AI to accelerate my learning and problem-solving in cybersecurity challenges, at Doctolib, we leverage tools like GitHub Copilot, Cursor, and Claude Code to streamline routine coding tasks, accelerate debugging, and enhance code exploration. The goal isn't to replace our expertise, but to augment it allowing us to focus on architectural decisions, complex problem-solving, and innovative solutions that improve healthcare for millions of patients.

Whether it's analyzing nginx configurations in a CTF challenge or refactoring critical healthcare infrastructure at Doctolib, AI serves as an amplifier of human intelligence. The key lesson from both contexts remains the same: AI is most powerful when it enhances human judgment, not when it replaces it.

Thank you for reading. If you have any questions or insights to share, feel free to reach out or leave a comment.

Special thanks to Justin Rabiller for reviewing this article and providing valuable insights.

Javascript console API : 9 helpful tips

Thomas Betous — Mon, 27 Jan 2020 13:51:29 +0000

If you daily work with javascript, I bet you use the console.log method a lot. But have you already tried to see what the console object looks like ?

Well, let's have a look :

As you can see, console object own far more methods than log. The purpose of this article is to demistify console API and show you what you can do with it. At the end of this article you should be able to display your logs correctly, evaluate performance of your code and debug your code more efficiently. This article should be useful if you use javascript both for browser or nodeJS !

🎛️ Use logging levels

Use different logging levels can be very useful to easily debug and observe how your application runs. Console API has several methods to log a message :

log : It will display general message in the console
debug : It will display debug message in the console
info : It will display informative message in the console
warn : It will display a warning message in the console
error : It will display a error message in the console

Each of these methods can be used with two different ways.

You can pass as argument one or more objects you want to display
You can pass as first argument a string with substitution strings and each of these will pull the next argument in order to format the string.

Let's see an example :

// with one or more objects as arguement
console.info("Toto", 1, object)

// Displays log :
// Toto 1 {test: 1}

// With the substitution strings
console.info("Hello, my name is %s. I am %d.", "Thomas", 30);

// Displays log :
// Hello, my name is Thomas. I am 30.

If you log a lot of messages, keep in mind that some browsers like Chrome or Firefox allow to filter logs with regex and logging level :

Chrome : console example with log filter (exclude warning)

Firefox : console example with log filter (exclude warning)

Note that the logging level of messages produce with log method can be different between browsers. For example Chrome will not make differences between log and info while Firefox will.

Finally, if you use nodeJS, you should know that log, debug and info are the same methods, they all print messages to stdout. warn and error are the same methods, they both print messages to stderr.

🗃️ Group logs

Sometime it can be useful to group your log messages in order to make them more readable. Console API has several methods to group log messages :

group : Creates a new inline group, indenting all following output by another level. To move back out a level, call groupEnd().
groupCollapsed : Creates a new inline group, indenting all following output by another level. However, unlike group() this starts with the inline group collapsed requiring the use of a disclosure button to expand it. To move back out a level, call groupEnd().
groupEnd : Exits the current inline group.

Here is a trivial example :

function sharedFunc(n) {
    console.group('sharedFunc', {n})
    for(let i = 1; i <= n; i++) {
    console.info('I have been called %d !', i)
    }
    console.groupEnd()
} 

function foo(n) {
    console.group('foo', {n})
    sharedFunc(n)
    console.groupEnd()
}

function bar(n) {
    console.groupCollapsed('bar', {n})
    sharedFunc(n)
    console.groupEnd()
}

foo(1)
bar(2)
bar(3)
foo(1)

The result of this will group your log messages by indenting them and making them more readable :

Chrome : Group log messages

You can see there is a little arrow next to each group that allow to fold or unfold the content of a group.

When you use group method, the group is automatically unfold
When you use groupCollapsed method, the group is automatically fold

Note that the interface may differ between browsers.

Finally, if you use nodeJS you will not have the ability to fold or unfold groups and only the indentation will be displayed. Consequently, group and groupCollapsed are the same method.

✅ Assert what is expected

Have you already written a piece of code which the goal is to debug by displaying a log message if something is wrong? Console API has a method to check an assert and display a log message if it is false:

assert : Log a message and stack trace to console if the first argument is false.

This method can be used with two different ways :

You can pass as argument one or more objects you want to display
You can pass as first argument a string with substitution strings and each of these will pull the next argument in order to format the string.

const life = 42
const object = {test: 1}

// with one or more objects as arguement
console.assert(life === 43, 'toto', 1, object)

// Displays error log :
// Assertion failed: Toto 1 {test: 1}

// With the substitution strings
console.assert(life === 43, 'life should be %d', 42)

// Displays error log :
// Assertion failed: life should be 42

Here is the result you will have in Chrome :

Chrome : console.assert result

With this syntax you can write your debug code with a faster and easier way than a console.error wrapped in a condition block.

Finally, if you use nodeJS, you should know that even if assert method works well, it sends log messages to stdout. It is recommended to use assertion API that provides more methods and sends log messages to stderr by throwing AssertionError when assertion is false.

🧮 Count code execution

While you are debbuging, you may want to know how many time a piece of code or a function is executed. Console API has several methods to log how many time your code has been executed :

count : Log the number of times this line has been called with the given label.
countReset : Resets the value of the counter with the given label.

The count method associates a label with a count value in the same way as a map. Each time you will call the method you will increment the associate value by one and display its value in log. Note that if no label is given, the string 'default' is set as label. Let's see an example :

function resetDay() {
   console.countReset('wake')
   console.countReset('exercise')
   console.countReset('eat')
   console.countReset('work')
   console.countReset('play')
   console.countReset('sleep')
}

for(let i = 0; i < 2; i++) {
   console.group(`day ${i}`) 
   console.count('wake')
   console.count('exercise')
   console.count('eat')
   console.count('work')
   console.count('eat')
   console.count('work')
   console.count('play')
   console.count('eat')
   console.count('sleep')
   resetDay()
   console.groupEnd() 
}

Here is the result you will have in Chrome :

Chrome : console.count result

⏱️ Time code execution

When your app seems to be slow you may want to start to time your code in order to know where you need optimizations. Console API has several methods to time your code execution :

time : Starts a timer with a name specified as an input parameter.
timeLog : Logs the value of the specified timer to the console.
timeEnd : Stops the specified timer and logs the elapsed timein seconds since it started.

Note that if no name is given, the string 'default' is set as name. Let's see an example :

console.time('test')
setTimeout(() => {
   console.timeLog('test')
   setTimeout(() => {
       console.timeEnd('test')  
   }, 3000)
}, 3000)

Here is the result in Chrome :

Chrome : Time the execution

📍 Add markers

If you use browser performance tool, you should know that it is possible to add markers in the execution workflow. This displays events in the tool interface making your debugging easier. Console API has a method to do that :

timeStamp : Adds a marker to the browser's performance tools.

console.timeStamp('test')

Here is the result in Firefox :

Firefox Performance tool: console.timeStamp result with string 'test'

✨ Display data in a table

When you want to display a complex object or array in the console, you should known that it is possible to display it as a table easying its read. Console API has a method to do that :

table : Displays tabular data as a table

Here is an example :

const robert = {name: "Robert", age: "30", favoriteColor: "blue"}
const jack = {name: "Jack", age: "35", favoriteColor: "pink"}
const marie = {name: "Marie", age: "20", favoriteColor: "green"}
const tom = {name: "Tom", age: "24", favoriteColor: "yellow"}
const people = [robert, jack, marie, tom]

console.table(jack)
console.table(people)

Here is the result in Chrome :

Chrome : console.table result

🔎 Display stack trace

While debugging you may want to know the call path of a point of your code execution while running. Console API has a method to display the stack trace :

trace : Outputs a stack trace.

Here is how to use it :

function foo() {
  function bar() {
    console.trace();
  }
  bar();
}

foo();

Here is the result in Chrome :

Chrome : console.trace result

🧼 Clean the console

When your console become a mess and you want to erase all of it, the console API provide you with a method to do that :

clear : Clear the console.

Here is how to use it :

// This will clear the console
console.clear()

Here is the result in Chrome :

Chrome : console.clear result

🎉 Congratulations !

Congratulations ! You know all you need to know about console API ! Hope it will help you in your future debugging sessions.

If you liked this post, do not hesitate to :

Follow me on twitter: @tbetous
Share this post !

Thank you for showing interest and reading this 🎉

👷 How to make conditionnal resources in terraform?

Thomas Betous — Wed, 11 Sep 2019 07:54:30 +0000

I’d like to share my experience about conditional resources in terraform with this short article.

Use case 🤔

Here is my use case. I am currently experiment lambdas (AWS cloud functions) for a project. My problem is that I don’t know which programming language is the most suitable for my use case. This is why I would like to make a benchmark about execution time and memory consumption for each language.

What I want is to create a terraform configuration that is able to switch my lambda from javascript to java by setting a parameter to "javascript" or "java".

Solution 🤯

My solution was using meta-arguments. The count meta-argument allows to specify how many instances you want to create.

👉 Step 1 : Create your input parameter

variable "lambda_type" {
  type    = "string"
  default = "java"
}

👉 Step 2 : Create your resources

locals {
  my_function_name = "awesome-function"
}

resource "aws_lambda_function" "my_lambda_java" {
  filename         = "lambda.jar"
  function_name    = "${local.my_function_name}"
  handler          = "Handler"
  runtime          = "java8"
  count            = "${var.lambda_type == "java" ? 1 : 0}"
}

resource "aws_lambda_function" "my_lambda_javascript" {
  filename         = "lambda.jar"
  function_name    = "${local.my_function_name}"
  handler          = "index.handler"
  runtime          = "nodejs10.x"
  count            = "${var.lambda_type == "javascript" ? 1 : 0}"
}

Note the ternary condition to set count to 0 or 1 in function of lambda_type value.

👉 Step 3 : Create a data variable to access your conditional resources from the same id

data "aws_lambda_function" "my_lambda" {
  function_name = "${local.my_function_name}"
  depends_on    = ["aws_lambda_function.my_lambda_java", "aws_lambda_function.my_lambda_javascript"]
}

// For instance if your lambda is attached to another resource, 
// you just have to use the same resource id for both (java & javascript)
resource "aws_lambda_permission" "my_lambda_permission" {
  statement_id  = "AllowExecutionFromSNS"
  action        = "lambda:InvokeFunction"
  function_name = "${data.aws_lambda_function.my_lambda.arn}"
  principal     = "sns.amazonaws.com"
  source_arn    = "${aws_sns_topic.topic.arn}"
}

Please note that the depends_on property is really important. If you don't use that property, terraform will try to fetch lambda function that doesn't exist yet. Plus, this only work for terraform 0.12 which allows to use depends_on with resource with count = 0.

👉 Step 4 : Plan and apply your terraform

Finally, you just have to apply your terraform configuration with the suitable parameter :

# For javascript
$ terraform plan --var "lambda-type=javascript"
# If the plan is correct to what you expect :
$ terraform apply --var "lambda-type=javascript"

# For java
$ terraform plan --var "lambda-type=java"
# If the plan is correct to what you expect :
$ terraform apply --var "lambda-type=java"

👉 Step 5 : Clean resources (optional)

If you did some tests by following this article, do not forget to clean your environment by destroying resources !

$ terraform destroy

Congratulations ! 🎉

Congratulations ! You did it ! Now you can add resources conditionnaly and therefore make your terraform configuration more parameterizable !

If you liked this post, do not hesitate to :

Follow me on twitter: @tbetous
Share this post !

Thank You for showing interest and reading this 🎉

🛡️ How to safely access deeply nested values in javascript?

Thomas Betous — Thu, 05 Sep 2019 15:56:10 +0000

I would like to share a problem I had today and how I solved it. It is about the way to access deeply nested values in javascript. Here is a simple example :

const options = {
    notification: {
        enablePrivateMessage: true,
        enableCommentResponse: false
    }
}

const enablePrivateMessage = options.notification.enablePrivateMessage
const enableCommentResponse = options.notification.enableCommentResponse

What's the problem ?

This works fine, however what's happen if options or notification are undefined ?

const options = undefined
const enablePrivateMessage = options.notification.enablePrivateMessage
// Uncaught TypeError: Cannot read property 'notification' of undefined

const options = {}
const enablePrivateMessage = options.notification.enablePrivateMessage
// Uncaught TypeError: Cannot read property 'enablePrivateMessage' of undefined

Yep, that's embarrassing ! It's not safe to access deeply nested values if you're not sure that the intermediate values are set. In the previous example, I tried to access the property enablePrivateMessage of notification, but unfortunately notification has not been set in options and consequently is equal to undefined. The error message tells me that I tried to access enablePrivateMessage propery from something undefined.

How to solve it ?

A first solution to this problem could be to browse nested properties one at a time and check if their values are null or undefined before accessing to the following nested value.

const options = {}
const enablePrivateMessage = options && options.notification && options.notification.enablePrivateMessage 
// enablePrivateMessage == undefined

// alternative way
const enablePrivateMessage = !options ? 
    undefined : !options.notification ? 
        undefined : options.notification.enablePrivateMessage 
// enablePrivateMessage == undefined

Although this works for simple cases, it could be painful to write that if your object is very depth. The code would be very long and difficult to read. Fortunately as the same way as lodash get function, we can design a function to safely access properties. Here it is :

export const getPropValue = (object, path = '') =>
    path.split('.')
        .reduce((o, x) => o == undefined ? o : o[x]
        , object)

const options = {}
const enablePrivateMessage = getPropValue(options, 'notification.enablePrivateMessage')
// enablePrivateMessage == undefined

How does it work ? getPropValue is a function that takes two parameters. The first one is the object to query and the second one is the path to a nested prop we hope to find. When the function is executed, we split the path in an array in order to get all nested properties to browse.

// Example
// path = 'notification.enablePrivateMessage'
'notification.enablePrivateMessage'.split('.')
// ['notification', 'enablePrivateMessage']

Finally we execute a reduce function from that array with an aggregator initially set with the object to query. The reduce function browses all properties in the path and if one of these have an undefined value, then the result will be undefined. Otherwise the value of the nested prop is returned.

// Example 1 : All properties are defined in the path
// object = {notification: {enablePrivateMessage: true}}
// path = 'notification.enablePrivateMessage'
['notification', 'enablePrivateMessage'].reduce((o, x) => {
    console.log(o, x)
    return o == undefined ? o : o[x]
}, {notification: {enablePrivateMessage: true}})
// {notification: {enablePrivateMessage: true}} 'notification'
// {enablePrivateMessage: true} 'enablePrivateMessage'
// true

// Example 2 : notification is undefined
// object = {}
// path = 'notification.enablePrivateMessage'
['notification', 'enablePrivateMessage'].reduce((o, x) => {
    console.log(o, x)
    return o == undefined ? o : o[x]
}, {})
// {} 'notification'
// undefined

What's about ES6 destructuring ?

Well, that's good ! But since ES6, destructuring feature is available in Javascript. This feature is really nice and allows developpers to easily declare and set variables with the nested properties of an object.

const options = {
    notification: {
        enablePrivateMessage: true,
        enableCommentResponse: false
    }
}

const {notification: {enablePrivateMessage, enableCommentResponse}} = options

console.log(enablePrivateMessage)
// true

console.log(enableCommentResponse)
// false

However, I cannot use my getPropValue function in this case. If options is undefined, then the previous destructuring will result an error.

const options = undefined
const {notification: {enablePrivateMessage, enableCommentResponse}} = options
// Uncaught TypeError: Cannot destructure property `notification` of 'undefined' or 'null'.

A simple way to protect our code against that error is to set a fallback value if options is undefined. But it is not enough.

const options = undefined
const {notification: {enablePrivateMessage, enableCommentResponse}} = options || {}
// Uncaught TypeError: Cannot destructure property `enablePrivateMessage` of 'undefined' or 'null'

Once you did that, you need to set default values for all your nested properties before to get the wanted properties.

const options = undefined
let {notification: {enablePrivateMessage, enableCommentResponse} = {}} = options || {}

console.log(enablePrivateMessage)
// undefined

console.log(enableCommentResponse)
// undefined

This is not as convenient as getPropValue function if the properties you want are very depth. In this case, you should consider that destructuring may not be the best way to access your properties because your instruction will be too long to be readable. In this case I recommand to access your properties one at a time with getPropValue function.

Lodash can help you !

You should know that getPropValue is a function I designed for this post. In real life I use the lodash get function. It is really usefull in many cases and work likely getPropValue. There is an extra parameter that allow you to set a fallback value if your path reach an undefined value before to get the targeted property.

import { get } from 'lodash'

const options = {
    notification: {
        enablePrivateMessage: true,
        enableCommentResponse: false
    }
}

// Example 1 : Simple case
get(options, 'notification.enablePrivateMessage')
// true

// Example 2 : Error case with 'fallback' as fallback value
get(options, 'toto.tata', 'fallback')
// 'fallback'

And that's it! You know all you need to know to safely access deep nested values in javascript! Hope you enjoyed my first post in dev.to!