E is a clean slate no compromise language, built for object-capability security and distributed computing. JavaScript is one of the leakiest languages ever, created almost by accident, whose massive success imposes severe legacy compatibility constraints on its evolution. Caja is the surprising discovery of E-like security in a simple compatible subset of JavaScript. Based on lessons from Caja and others, we helped design the latest JavaScript standard, EcmaScript 5, to be trivially securable, be better for programming in the large and small, and be easier to learn. We show how EcmaScript 5 enables easy safe mashups. Time permitting, we will briefly touch on our future direction, Dr. SES—Distributed Resilient Secure EcmaScript—bringing E-like distributed computing to JavaScript as well.