ExposeFunction Leak

Detection approach

Exposed node/automation helper bindings leaked in the global window context. Puppeteer or Playwright unpatched exposed functions contain direct signature strings or custom binding keys that are absent on human consumer devices.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

None. Unique signature of exposed bindings from headless drivers.