Runtime side-effect analysis
Console activity monitor
A live experiment that watches for side effects often left by DevTools snippets, CDP evaluations, browser extensions, and injected automation. Signals are evidence to investigate, not proof that a visitor is a bot.
Observe consequences, not the console itself
Page JavaScript has no standard event that announces “someone evaluated a console command.” The monitor therefore combines independent traces that evaluated code may leave behind. A finding becomes more useful when several unrelated approaches agree.
Persistent runtime traces
These checks look for changes that remain observable after an evaluated expression has finished.
Global surface changes
The page snapshots every own key and descriptor on
globalThis, then checks for additions, removals,
assignments, and descriptor changes. Suspicious automation-like
names receive stronger weighting.
Console call provenance
Console methods are wrapped while their original behavior is preserved. Calls record method, argument types, and a sanitized stack classification. Anonymous, evaluated, blob, data, and extension sources are more interesting than this page’s URL.
Console and API integrity
Periodic integrity checks notice replaced console wrappers and
changes to observation-critical APIs such as
Reflect.ownKeys, MutationObserver,
eval, and the Function constructor.
Unhandled execution failures
Capturing listeners retain sanitized metadata for uncaught errors, failed script resources, and unhandled promise rejections. Their source and stack are classified with the same provenance rules used for console calls.
Injection and inspection traces
These checks watch browser surfaces commonly touched when custom code is introduced or inspected.
Executable DOM injection
A mutation observer identifies new scripts, frames, styles, embedded content, event-handler attributes, and other DOM edits. Inline code is represented only by length and a small fingerprint; its contents are not copied into the report.
Late script resources
Resource Timing observes scripts fetched after startup. This complements DOM observation when a node changes too quickly or another loader mediates the request, while retaining a URL with query strings and fragments removed.
Policy violations
If the hosting environment supplies Content Security Policy,
the standardized securitypolicyviolation event can
reveal blocked eval, inline code, or foreign script attempts.
The endpoint does not claim a policy exists when it does not.
Inspector canary
The page logs a harmless object with an accessor canary through the saved native console method. If a debugger or automation client deliberately reads that accessor, the interaction is recorded as low-confidence inspection evidence.
What remains invisible
The endpoint deliberately avoids timing traps, debugger pauses, viewport guesses, user-agent checks, and other broad fingerprinting. It also cannot turn absence of evidence into proof of a clean session.
- A read-only expression such as
2 + 2can leave no page-visible trace. - Console-scoped
let,const, and class bindings are not own window properties. - Code installed before this page’s monitor can become part of the baseline.
Preparing monitor…