Skip to main content
Below you’ll find answers to the questions that come up most often when teams are evaluating Heretic, integrating the collector, or interpreting verdicts in production. If your question isn’t covered here, email hello@heretic.quest.
A WAF fires rules against request patterns and a bot detection score gives you a probability that you then threshold yourself. Both approaches put the interpretation burden on you: you decide what score is “high enough” to block, and you tune that threshold as adversaries adapt.Heretic works differently. It measures physical and cryptographic properties of the connection — round-trip timing against the speed-of-light floor, TCP SYN fingerprint against declared OS, TLS group negotiation against declared browser — and returns a verdict with attached evidence, not a score. The verdict is one of five values: contradicted, refused, disputed, uncontradicted, or insufficient. Each is backed by the specific signals that produced it, so you know why the verdict was reached, not just what it was.Because Heretic is physics-based rather than behavioural-AI-based, it does not need a training corpus of “known bad” sessions, it does not drift as adversaries change their behavioural patterns, and it does not require you to pick or maintain a threshold. A contradiction either exists in the physics or it does not.
No. Heretic runs on your origin and operates entirely out of band. There are no reverse-proxy tollbooths in the request path, no DNS handovers to a third-party infrastructure, and no changes required to your CDN configuration.The @heretic-hq/collector script loads client-side on your page and sends its measurements directly to the Heretic edge (probe.heretic.quest). Your server calls the explain endpoint after receiving a session ID from the collector. Both of those interactions are additive — they do not modify how your existing traffic flows.
uncontradicted means that Heretic did not detect a contradiction between the session’s measured properties and its declared identity. It does not mean the session is clean, safe, or human. It means that all evidence families Heretic was able to measure aligned with the declared claims — there was nothing to contradict.Think of it like an alibi that checked out: the witness accounts were consistent, but you haven’t proven innocence, only the absence of a detected lie. A sophisticated adversary who spoofs every measurable surface consistently will receive an uncontradicted verdict. Your policy should treat uncontradicted as “no evidence of tampering found” rather than “verified legitimate.”For comparison: contradicted means at least one signal found a direct conflict between measurement and declaration; refused means the session declined to provide evidence in a way that is itself suspicious; disputed means signals point in different directions across families; insufficient means not enough evidence was collected to reach any conclusion.
Heretic’s six evidence families split across two measurement modes.The passive wire signals — network geometry, transport stack, and TLS construction — are read server-side, directly off the TCP/TLS/HTTP/2 connection as it arrives at the edge. No JavaScript is required for those families.The active measurement signals — compute, render, and the declared-values harvest — require code running inside the browser. CPU parallelism workloads, GPU shader outputs, canvas rasterisation, audio synthesis, and the navigator/screen/userAgentData surfaces can only be measured or read from inside the page context. That is what the @heretic-hq/collector script does.You need both halves to get six-family coverage. A session that skips the collector has only three families available, which reduces the maximum achievable verdict confidence and leaves the compute and render families silent.
Yes. Set render: false in the collector configuration:
This disables the entire render family — canvas measurement, audio measurement, and the identity.same-origin-cluster render clustering signal. All other evidence families continue to operate: network geometry, transport stack, TLS construction, compute, and declared values are unaffected.The render family is the only family that compares one session against others on your origin. If your deployment context or jurisdiction makes that comparison problematic, render: false removes it cleanly without degrading the rest of the measurement.
Session records live in edge memory for 15 minutes from the moment the session is created. After that window, the record is evicted and the session ID can no longer be resolved by the explain endpoint.Call the explain endpoint promptly after the collector resolves its session ID — the typical pattern is to send the session ID to your server in the same request that submits a form or triggers a sensitive action, then call explain server-side before processing that action. Do not queue session IDs for batch resolution: batching against a 15-minute window is fragile in production.The compact verdict projection (verdict + signals + network classification) is written to the dashboard store during the same 15-minute window and is retained there for 90 days, so you can review historical verdicts after the edge record has expired.
If Heretic cannot collect enough signal data to reach a conclusion, the verdict is insufficient. This is not the same as contradicted — it means Heretic found no contradiction, but also did not gather enough evidence across families to be confident in any verdict direction.Do not block sessions on insufficient alone. Some legitimate environments produce insufficient verdicts by design: virtual machines often suppress or abstract hardware signals, headless environments may lack GPU and audio contexts, and heavily privacy-hardened browsers may reduce the fidelity of declared-value surfaces. Blocking insufficient broadly will catch adversaries who deliberately suppress evidence, but it will also catch a meaningful slice of legitimate traffic.The recommended approach is to use insufficient as a signal for stepped-up friction — a CAPTCHA, an additional authentication factor, or a manual review queue — rather than an outright block. Reserve contradicted and refused for hard enforcement.
Request access at heretic.quest/#access. Approval grants you an API key on the apostate tier, which includes the full signal catalogue, the explain endpoint, and the live bare-metal Warsaw edge — at no cost.There are no feature restrictions during early access. You are integrating against the same signal set and the same edge infrastructure that paid tiers will use. The @heretic-hq/collector npm package is available immediately after your key is issued.If you need dedicated edges, custom signal co-design, or an enterprise agreement, email hello@heretic.quest to start an inquisition-tier conversation.

Related topics

Enforce Traffic Policy Using Heretic Verdicts and SignalsHeretic Quick Start: Collect Sessions and Read VerdictsHeretic Privacy: Data Collection, Retention, and DeletionInstall and Configure the Heretic Collector for Your SiteRead and Interpret Heretic Explain Endpoint Responses