no Selenium / Puppeteer / Playwright globals
Check id automation-globals
What an ordinary browser yields
None of the known driver globals present, and no puppeteer_ / cdc_ / $cdc_ prefixed keys on window.
What a detector infers
This check tests a fixed list of roughly two dozen known names against both window and document (Selenium's __webdriver_evaluate / __selenium_unwrapped / _Selenium_IDE_Recorder, ChromeDriver's $cdc_asdjflasutopfhvcZLmcfl_, domAutomationController, Watir's __lastWatirAlert, Playwright's __pwInitScripts and __playwright__binding__), then adds a prefix scan over Object.keys(window) for anything starting with puppeteer_, cdc_ or $cdc_. It passes only when the combined list is empty. These properties are not fingerprint signals in the statistical sense — they are working artifacts the driver injects into the page to do its job, so their presence is direct evidence of a specific tool rather than an inference from probability. The prefix scan matters because ChromeDriver's cdc_ variable name is build-derived, so enumerating a static list alone would miss renamed variants.
How to resolve it
These come from the driver and its injected bootstrap, not from your code. Use a launch path that evaluates in isolated worlds and does not bind helpers into the main world — clearcote with a clean Playwright launch exposes none of them. If you inject your own helpers, keep them out of the page's global scope.
Read in the wild by
Kasada
Iterates a hardcoded three-name list — "runHeadlessFixes", "overrideStatic", "playwright" — testing each with the `in` operator against window and against the contentWindow of a hidden iframe it creates, then reports which names were found in each realm as separate fields.
2.txt:12967 func_00bbe1 — r4 = ["runHeadlessFixes", "overrideStatic", "playwright"]; loop at 2.txt:12985-12986 tests `r6 in r7` where r7 = globalThis["window"]; 2.txt:12976-12977 r2 = _6994.lbg() (func_017d2a: document.createElement("iframe"), display:none, appendChild) → r7 = r2["contentWindow"], tested at 12992 and reported as fields w / i
PerimeterX / HUMAN
Enumerates named driver artifacts on window and document — __nightmare, geb, _Selenium_IDE_Recorder, _phantom / callPhantom, domAutomation / domAutomationController, and document.__webdriver_script_fn — shipping each as its own boolean field, alongside a native-function test on RunPerfTest; separately runs a prefix scan over Object.getOwnPropertyNames(window) for names beginning 'cypressSendToServer', and, only when the browser looks like Firefox, probes for Playwright's patched Firefox by constructing a Worker on chrome://juggler/content and recording whether it throws.
PerimeterX main.min.js as served on ifood (sha256 e042d5de834333985610691dbd6e435ca61a744e6a17271e4bbb4c21706a754e; identified as PX by its _pxAppId / px-captcha markers). `function Cl(t)`, in source order: `t["VGBhahICYFA="]=!!hS.__nightmare,t["OSUMb39HDF4="]=kz(hS.RunPerfTest),t["Dh47VEh4MW8="]=!!hS.geb,t[hQ(775)]=!!hS._Selenium_IDE_Recorder,t["PSkIY3tIDFE="]=!!hS._phantom||!!hS[hQ(776)],t["WQUsDxxhLj8="]=!!hT.__webdriver_script_fn,t[hQ(777)]=!!hS.domAutomation||!!hS[hQ(778)]` — where hS=window, hT=document, hQ(776)='callPhantom', hQ(778)='domAutomationController', and kz(t)=`hR(t)===ie&&new RegExp("\{\s*\[native code\]\s*\}","").test(""+t)` (a native-function test, not a presence check). Prefix scan, same function: `var n=jb(hQ(780));t["FCAhKlFDJBk="]=Object[hQ(273)](hS)[hQ(781)]((function(t){return 0===t[hQ(240)](n)}))` — hQ(780)='Y3lwcmVzc1NlbmRUb1NlcnZlcg==' which base64-decodes to 'cypressSendToServer', hQ(273)='getOwnPropertyNames', hQ(781)='some', hQ(240)='indexOf'. Juggler probe: `function Bh(){try{var t=jb("Y2hyb21lOi8vanVnZ2xlci9jb250ZW50");new Worker(t);return!0}catch(t){return!1}}` ('chrome://juggler/content'), wired at `(oM()||Bk())&&(t[0][hQ(684)]=Bh(),t[0]["HUloQ1gpY3Q="]=Bi())` where oM()=`-1!==hU.userAgent.indexOf(hQ(183))` with hQ(183)='Firefox' and Bk()=`CSS[hQ(700)](hQ(701))` = CSS.supports('-moz-appearance: none'). All hQ(n) indices resolve through the extracted string table (hQ_map.json, 1152 entries) produced by the study's extract_hQ.js decoder.
Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- navigator.webdriver does not assert WebDriver control
webdriver-offThis check is intentionally one-way. The WebDriver specification defines navigator.webdriver as the browser's assertion that it is under… - navigator.webdriver is a native prototype getter returning false
webdriver-descriptor-integrityRather than reading the value, this check inspects the property's shape: it requires a getter on Navigator.prototype whose… - DevTools Runtime serialization is not active
runtime-enable-leakAn attached DevTools Runtime domain serialises console arguments and reads an Error stack accessor. - No Puppeteer / Playwright sourceURL marker
sourceurl-leakPuppeteer and Playwright evaluation labels can appear in main-world Error stacks. - No controller code crossed the main-world canary
main-world-executionAn early DOM canary records main-world calls, but page code and extensions can also call it, so this is contextual. - No exposed Puppeteer / Playwright binding
exposed-binding-leaksExposed functions leave Playwright/Puppeteer registries, prefixes, source text, or __installed markers. - Content Security Policy is enforced
csp-bypassThe audit excludes data: scripts. Execution despite script-src is direct CSP-bypass behavior. - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family automation-globals belongs to.