hi @alexbjorlig , just confirming - is this for 21risk?

the most immediate thing if a user has reached out about this is to create a firewall bypass rule to let your user through https://vercel.com/docs/vercel-firewall/vercel-waf/system-bypass-rules

I’ve looked through the logs of botid from your project and I can see some sessions being flagged by our partner Kasada as bots. Can you give me a rough time stamp of when the classification happened? will help narrow down the exact session and reason

Thanks for looking into this 👍

Yes, it's 21RISK. RequestId was lhr1::c4cck-1756987608330-fdfd3db13a58 at Sep 4, 2025 14:06:48 CEST.

Regarding the WAF rule, something like this?

Not hostname because it’d bypass more than just that user, if that user only accesses your site from a certain ip, or ASN or user agent, you should bypass that

Otherwise in code you can add a feature flag like

If (user.email===…)

Break;

// only if user is not that email, then

CheckBotID()

Sorry for bad formatting, was on mobile 😛

Ok, we already deployed that as a hotfix. But what is the underlying challenge - why was the user identified as a false positive?

Dug deeper and figured it out - that user is using ZScalar, and it’s acting like a reverse proxy and obscuring signals we rely on for bot protection.

I’m working with the security team to detect usage of VPN’s and not block ZScalar users - but this is a problem with any reverse proxy or zero trust proxy in front.

Thank you so much for sharing this insight with us, it's great to know why. Not that we can do much about it, but you know 😃

Hopefully the strategies can be improved, so legit users are not detected as bots in the future