The Open Fingerprint Database Behind Scalpel Stack

## Why it matters

Detection is only as trustworthy as the data behind it. A closed, server-side database can change or disappear without notice. You build a stack detector around it and one day it goes dark or the vendor pivots and sells the business.

Scalpel Stack bundles an open, pinned database: the rules can be audited, the snapshot cannot silently shift under you, and the whole extension is GPL-3.0. No rug pull is possible. Because the data lives locally inside the extension, detection runs without any server call. Your browsing never touches our infrastructure.

## How it works

The fingerprint database is the enthec/webappanalyzer project, a community-maintained collection of technology fingerprints. Scalpel Stack pins a specific commit and version of this database at build time. That exact snapshot is bundled into the extension and never changes until you manually update it.

The database is JSON: each technology has a name, one or more categories, and a list of fingerprints. Each fingerprint is a pattern to match against a specific detection channel: an HTTP header regex, a meta tag content string, a script URL fragment, a cookie name, a JavaScript global dot-path, or a DOM selector.

The detection engine reads these patterns and compiles them into an efficient lookup structure at startup. When a page is scanned, every detection vector (headers, scripts, cookies, globals, DOM, HTML) is matched against the compiled patterns. A match records both the technology name and the version (if one was captured).

## What does not matter

The database is only as fresh as your last update. A new library released last month will not be detected until you run npm run update-db and reload the extension. This is a trade-off for transparency and auditability: you can see exactly what you are running.

The GPL-3.0 license means the extension itself must be GPL-3.0 as well. If you build a fork that embeds this data, your fork's got to be open source and GPL-compatible.

## Code example

A single technology entry in the database looks like this:

{
  "name": "WordPress",
  "cats": [1],
  "headers": {
    "X-Powered-By": "WordPress"
  },
  "html": "<meta name=\"generator\" content=\"WordPress ([\\d.]+)\" />",
  "implies": ["PHP", "MySQL"],
  "website": "https://wordpress.org"
}
Copy

When Scalpel Stack scans a page and finds <meta name="generator" content="WordPress 6.4.2">, it matches this pattern, extracts the version 6.4.2, and reports WordPress with version 6.4.2.

The implies field tells the engine that WordPress implies PHP and MySQL, so those are reported too, with lower confidence.

## How Scalpel Stack shows it

The footer of the popup carries a "fingerprint DB ↗" link pointing to the enthec/webappanalyzer repository. Beside it sits a small badge showing the snapshot date and its freshness (fresh, aging, or stale). The badge carries the "Fingerprint database freshness" concept's ?.

Clicking "Update fingerprint database" in settings runs npm run update-db to fetch the latest upstream snapshot.