Hash-Only Correlation

JA4 Research Surface

Document how Fingerprint handles JA4-style metadata and Vercel JA4 digest signals safely across public and protected contexts.

JA4 Summary APITrust Policy

Public-Safe Boundary

Local analysis works without login. Protected actions use PLATPHORM_API_KEY only.

Raw IPs, raw high-entropy component values, full visitor hashes, and unredacted JA4 digest metadata are excluded from public surfaces.

Digest Policy

Active

Unredacted JA4 digest metadata is never exposed publicly. Public output shows presence and hash-only correlation metadata.

Vercel Metadata

Active

Safe Vercel request metadata is normalized, IP fields are hashed or redacted, and authorization/cookie data is excluded.

Protected Correlation

Protected

Cross-site JA4 correlation requires PLATPHORM_API_KEY and a configured backend. The public page does not invent matches.