Anti-Detection

Fresh

Source: BIBLE.md, bible/understand-everything.md (The detection problem section)

Detection scores (proven)

Test	Result
CreepJS	0% headless, 0% stealth
BrowserScan	100% fingerprint authenticity
Sannysoft	All green, WebDriver missing

The "less is more" principle

The single most important lesson from building V1 and Ghost Engine: every custom hook is a fingerprinting tell.

V1's Golden 6 score went from ~70 to 98/100 by deleting 30 Chrome launch arguments down to 4. The big antidetect engine on port 3500 fixed SSL errors by removing three features that were default-on. Commercial antidetect solutions (more flags, more JS overrides, more spoofing) get it exactly backwards. Every modification is detectable.

The CreepJS fix (2026-05-18)

CreepJS is an open-source browser fingerprinting detection tool. It was reporting Ghost Engine as 33% headless. The root cause:

Ghost Engine was using Object.defineProperty(navigator, 'webdriver', {get: () => undefined}) to hide the webdriver flag. This is a common technique. But CreepJS has three checks in its webDriverIsOn function:

1. CSS supports('border-end-end-radius') AND webdriver is undefined
2. navigator.webdriver is truthy
3. lieProps['Navigator.webdriver'] is truthy: checks if the property was tampered with

The JS patch passed checks 1 and 2 but triggered check 3. CreepJS detected the prototype modification as a lie.

The fix: use --disable-blink-features=AutomationControlled as a Chrome launch flag. This prevents the Blink rendering engine from setting navigator.webdriver=true at the C++ level. No JavaScript needed. No lie detection triggered.

Three API stubs were added too:

• ContentIndex
• ContactsManager
• navigator.connection.downlink (set to realistic max)

These APIs exist in real Chrome but are missing in Puppeteer's Chromium build. Adding them reduced CreepJS's "like headless" score from 25% to 6%.

The fingerprint stack

15-vector fingerprint evasion (inherited from V1)

Vector	What it covers
WebGL	renderer string, unmasked vendor
Canvas	rendering noise per-account
Audio	AudioContext fingerprint
Fonts	enumerated font list
Plugins	plugins list
Screen	resolution, color depth, locked 1366x768
Timezone	from geo
Language	from country
navigator	userAgent, platform, vendor, hardwareConcurrency
Connection	downlink, downlinkMax, effectiveType
Memory	deviceMemory
WebRTC	local IP leak protection
DNS	leak protection via proxy
Battery	randomized
Permissions	spoofed answers per origin

Per-account variations

Each account gets deterministic per-account fingerprint variations via randomizeFingerprint(email, os):

• CPU cores (4, 8, or 16)
• Device memory (4, 8, or 16 GB)
• Connection downlink
• Device pixel ratio

The variations are deterministic by email hash so each account has a consistent fingerprint across launches. Stored AES-256-GCM encrypted in fingerprint-store.mjs.

What's in the launch args

V1 and Ghost Engine both run with a minimal launch arg list:

--disable-blink-features=AutomationControlled
--disable-features=IsolateOrigins,site-per-process,Translate
--no-default-browser-check
--no-first-run

That is the full list. No custom user-agent, no --disable-web-security, no --use-fake-ui-for-media-stream. Less is more.

isTrusted: the V2 difference

V1 passes fingerprinting tests but still uses CDP for input. CDP produces isTrusted: false on every event.

Advanced detection JS checks event.isTrusted on click and keypress handlers. Sites like Reddit shadow-ban accounts that pass every fingerprint test because the clicks are not real.

Ghost Engine fixes this with OS-level and ADB input. Both produce isTrusted: true events identical to physical human input. See Three I/O Modes.

What's proven vs aspirational

Proven

• Engine boots and runs (704 routes, 109+ plugins)
• CreepJS: 0% headless, 0% stealth
• Plugin system works
• Account store, scheduling, persistence all functional
• Dashboard operational
• Cookie refresh with proxy pool fallback
• 50 accounts imported and accessible

Built but untested

• Ghost mode OS-level input (isTrusted:true in theory, not validated against real detection sites)
• Vision navigation (built for 3 providers, not tested against real login flows)
• ADB mobile backend (no Android device or Waydroid connected yet)
• Ghost mode on Reddit, LinkedIn, Facebook (the whole reason it exists, not yet tested)

The claim "Ghost mode will fix Reddit shadow-banning" is architecturally sound but unverified. OS-level input IS isTrusted: true. Nobody has run Ghost Engine against Reddit's actual detection yet.