Detection Vectors

## Why it matters

Not all evidence is equal. A Server header is authoritative but only visible after an explicit fetch; a <meta name="generator"> is easy to read but trivial to spoof; a JavaScript global is strong but needs the page's own JavaScript world to be accessible.

Knowing which vector fired tells you how much to trust a detection, and which ones require the on-demand header check. When you expand a detection in Scalpel Stack, every evidence line shows its vector badge so you can judge the strength yourself. A vector is not just a technical detail; it is part of the credibility of the result.

## How it works

Scalpel Stack reads nine different channels during a scan:

1. HTTP response headers (Server, X-Powered-By, X-Generator, Via, etc.). Authoritative but invisible until you click "Check HTTP headers" (an opt-in fetch). The most reliable channel for backend technologies.

2. Meta tags (generator, viewport, application-name, etc.). Visible in the page source immediately. Easy to read but trivial to remove or spoof. The gold standard for CMS detection when present.

3. Script tag URLs (the src attribute). The external scripts a page loads from, often named after the library. Carries version info in query strings or paths.

4. Inline script text. The actual JavaScript code between <script> tags, including analytics snippets and initializers. Patterns matched against the first portion of inline scripts.

5. Cookies (names only). The document.cookie entries already in the tab, read entirely locally. Platform defaults like PHPSESSID or _shopify_s are strong signals.

6. JavaScript globals (window variables). Probed via a safe MAIN-world injection; requires the page's own JavaScript to have run. Catches single-page apps that leave almost nothing in the static HTML.

7. DOM elements. CSS selectors matched against the live or parsed DOM. Catches widgets, builders and custom elements.

8. HTML pattern (comments, class names, data attributes). Matched against the rendered page source. The catch-all for traces that don't fit other vectors.

9. Page URL (path and query). The URL itself sometimes names the technology (e.g. /administrator/ is Joomla, /wp-admin/ is WordPress).

Each vector is available at different times: headers need an opt-in fetch; JS globals need the page's JavaScript to have run; everything else is read from the static HTML immediately.

## What does not matter

The order of vectors does not matter. Scalpel Stack does not rank one vector inherently above another; instead, each vector-pattern pair in the open database carries its own confidence weight. A single meta tag might score 90, while an HTML comment scores 20. The vector badge tells you which channel fired; the confidence number tells you how much to trust that particular match.

A vector is not the same as a business relationship. Reading a script from cdn.shopify.com means the page loads from Shopify's CDN, not that Shopify owns or runs the site. The detection is proof of the trace, not proof of a partnership.

## Code example

Here is what evidence from different vectors looks like in the popup:

Technology: Next.js
├─ Script URL: /_next/static/chunks/main.js (confidence 95)
├─ JS Global: window.__NEXT_DATA__ (confidence 90)
├─ HTML Pattern: <meta name="next..."> (confidence 70)

Technology: WordPress
├─ Meta tag: <meta name="generator" content="WordPress 6.4.2"> (confidence 98)
├─ Cookie: wordpress_logged_in_* (confidence 85)
├─ HTML Pattern: /wp-content/ (confidence 60)

Technology: Cloudflare
├─ HTTP Header: Server: cloudflare (confidence 92)
├─ HTTP Header: cf-ray: ... (confidence 88)
Copy

Each evidence line shows its vector badge, the specific key or pattern, and the matched text. You can see the exact trace in the page and verify it yourself in your browser's DevTools.

## How Scalpel Stack shows it

Every evidence line in the expanded view begins with a vector badge (a small glyph or label) showing which channel the detection came from: "meta", "script", "header", "js", "cookie", "html", "dom", "url", etc. If a detection vector is not recognized or is generic, it defaults to this concept's help page.

The badges are colour-coded in the popup: green for high-confidence vectors (like a meta generator tag), amber for medium, and grey for weak or spoofable signals. The vector is your first signal of which detection to trust most.