The Probie scanner

What it is

When someone dispatches Probie to a website (from https://probie.dev/dispatch), Probie opens the website in a real Chromium browser, clicks through a few pages the way a first-time visitor would, and writes a report of the bugs it could verify. It browses deliberately and creates no accounts unless the person who dispatched it asked for that.

How it identifies itself

Every request to the website under inspection is signed with an Ed25519 key using HTTP Message Signatures (RFC 9421), the Web Bot Auth method that Cloudflare and other providers verify. The signed requests carry these headers:

The public key is published at https://probie.dev/.well-known/http-message-signatures-directory.

How it handles access controls

Probie reads robots.txt and stays out of anything it disallows. When a website answers with a bot challenge, a CAPTCHA, or an HTTP 403 or 429, Probie stops. The report for that dispatch says the website was protected and nothing more.

How to allow Probie

Pick whichever fits your setup:

• Cloudflare: allow verified bots in your bot settings (Super Bot Fight Mode or Bot Management).
• Other bot protection (PerimeterX, DataDome, Akamai, a CAPTCHA, or a firewall in front of the web server): verify Probie's signed Web Bot Auth identity against the public key above before allowing it.

Then dispatch Probie again.

How to block Probie

Add a Disallow rule for Probie's paths in robots.txt, or block requests that carry the header Signature-Agent: "https://probie.dev". Probie honors both on the next inspection.

Contact

Questions about the scanner or a specific inspection? Email [email protected].