heretic(config) is the same function from the script tag and the npm package. It runs once per page. Pass the complete configuration to the first call.
Result
requestId is a 32-character lowercase hex string. With ok: true, the verdict is ready for your backend to read. With ok: false and sessionCreated: true, collection did not finish; the session becomes refused 15 seconds after opening. With sessionCreated: false, no result exists. Treat reason as explanatory text, not a stable error code.
Options
Zero data retention
Content security policy
https://probe.heretic.tech to script-src when loading by script tag. Blocked blob workers reduce compute coverage. A CSP that blocks the collector’s temporary stylesheet leaves the CSS/media check unavailable; it does not create a disagreement finding. Do not put a CDN or proxy between the browser and the sensor; the sensor would measure the proxy.
Exports
heretic, resolveEndpoint, PROBE_VERSION, SURFACE_VERSION, RENDER_VERSION, COLLECTOR_VERSION, TELEMETRY_CONTRACT_VERSION, WASM_PROBE_VERSION. The script tag exposes the same values as properties of heretic.
surface: false disables detailed surface and realm collection. Passive automation, navigator getter, reflection and plugin checks still run. Collector 0.2.5 also runs the required canvas byte/PNG, permission result, media-query, rectangle origin and empty-text font checks with both surface: false and render: false. Those checks also run when the timed probe budget is exhausted. See fingerprinting coverage.