drop front door waf/access json or csv · block clusters · bypass hints · scanner ua · geo spike · runs locally
flags waf block clusters · log-then-allow bypass hints · scanner ua · geo concentration
heuristic screener · parses exports locally · not definitive proof