Serverless applications process sensitive information in a multi-tenancy environment, and remain susceptible to cache and timing side-channel attacks. While mitigations exist for native applications, such as crypto, they have not been adapted for serverless applications, which often use dynamically typed languages. We propose an approach to mitigate side channels within language runtimes, which relies on applying constant-time transformations and oblivious RAM techniques at different stages within the runtime pipeline. We are developing a tool, Scooti, which demonstrates the feasibility of this approach within the JavaScript engine, V8. We will formally prove the guarantees and empirically evaluate the performance and security properties of the Scooti.