Skip to main content
Heretic checks for automation markers, altered browser APIs, and conflicts between browser claims and measured behavior. Each finding describes the observation that triggered it.

​
Checks on your page

Basic API integrity checks run even with surface: false or an exhausted timing budget. They inspect existing properties without modifying browser globals or requesting permissions. The canvas, permission and media checks also run with render: false. A blocked stylesheet or a changing media environment makes the media check unavailable. Optional collection adds the detailed comparisons listed above. The public probe demo also runs active driver traps in its own page. Those traps are not installed on customer pages. The signal reference identifies their finding IDs.

​
Interpreting a finding

A replaced navigator getter establishes a replaced property. A WebDriver flag establishes declared automation. A plugin inconsistency establishes a disagreement between browser objects. Privacy extensions and application libraries can trigger some of these checks. Your backend decides how to treat the reported condition. Client-side checks still depend on browser-supplied data. A coordinated rewrite can conceal changes, including changes to the check’s own output. uncontradicted means no conclusive contradiction was found in the completed measurements. It does not establish a human visitor or a unique device.

​
Performance findings

CPU/GPU throughput comparisons, core-count estimates, and cross-context GPU differences are conditional. Workload contention, power settings, or an adapter change can affect these results. They remain in the response but do not set contradicted. The fibre round-trip comparison is also conditional because the connection’s transmission medium is unknown. The vacuum check tests the distance implied by the claimed timezone against the speed of light. It does not locate the visitor. Arithmetic contradictions, confirmed API replacements, explicit automation, and protocol violations can be conclusive. Read the tier returned with each finding.

​
Required Wasm results

Every current probe must return the required Wasm measurements. A missing or failed run returns refused. A complete result with incorrect workload parameters or checksum produces a contradiction. The checksum verifies the answer, not the hardware that computed it.

​
Device identifiers

The instance and machine identifiers use normalized browser inputs. The separate identity.rendering signature uses stable Canvas and WebGL outputs without timezone or display declarations. If either raster is missing or unstable, Heretic omits that signature. All three are conditional. A browser update, graphics change, privacy setting, or fabricated output can alter an identifier. Distinct devices can produce the same value. Follow the scope and version rules when comparing results.

​
Read a result

Fetch the verdict on your backend and check that it belongs to the expected site and pending action. Use families[].coverage and sensor to inspect measurement availability. Read the finding IDs and tiers before applying your policy. The demo’s Why this result section lists the findings that caused a contradicted or refused verdict. Weak and conditional findings keep their own status. An HTTP-construction finding can describe a browser API replacement or driver marker as well as an HTTP header issue. See signup rules for a complete backend sequence.