navigator.webdriver does not assert WebDriver control

PerimeterX / HUMAN

Collects navigator.webdriver twice over: once coerced to a string, and separately as its own field recording whether the property exists on navigator at all.

PerimeterX main.min.js (ifood deployment): `function AL(){return hU[AC]+""}` and `function AM(){return AC in hU?1:0}`, where `hU=navigator` and `AC=hQ(512)`, with the script's string table resolving 512 to "webdriver" (hQ_map.json:514). Their results land in the EV2 payload at main.min.js:7710-7711 as `t[hQ(745)]=t["GCQtLl1BLR0="]=AL()` and `t["aRVcHy92XiQ="]=t["QS00ZwRJNFE="]=AM()`; captured payloads carry "GCQtLl1BLR0=": "false" and "QS00ZwRJNFE=": 1 (ev2_template.json:106,108 and all six samples in stample/ifood/sample/*/decoded_payload_2.json).

CreepJS

CreepJS, an open-source research demo rather than a production detector, reads navigator.webdriver directly: its webDriverIsOn flag trips on a truthy value, on its own lie-detector flagging the property, or — behind a CSS feature test — on the property being absent entirely. It is one of three inputs to CreepJS's headless rating.

src/headless/index.ts lines 97-102, inside `headless: { ... }`: `webDriverIsOn: ((CSS.supports('border-end-end-radius: initial') && navigator.webdriver === undefined) || !!navigator.webdriver || !!lieProps['Navigator.webdriver'])` — and line 167: `const headlessRating = +((headlessKeys.filter((key) => headless[key]).length / headlessKeys.length) * 100).toFixed(0)`, where `headless` holds exactly three keys (webDriverIsOn, hasHeadlessUA, hasHeadlessWorkerUA).

Kasada

Reads the automation flag in BOTH realms, because an override installed on the page's navigator does not follow into a fresh iframe.

window_navigator_webdriver, iframe_navigator_webdriver