Glossary

camada glossary

Allow-list: Clients you have said to let through. An allow-list entry always wins over a block, wherever the two overlap. See Rules and list entries.
Bad actor: Anyone abusing your app, whatever they run on: attackers using AI, AI agents that act like attackers, credential stuffers, scrapers and CVE exploit scanners. Customers and verified search crawlers are not bad actors.
Beacon: An optional addition to your HTML pages. It cuts false positives by showing which sessions are real browsers. See Docs.
Blocklist: The clients your app refuses. The SDK holds it and checks each request against it, so enforcement never waits for a model. You can see each entry and its reason in the app. See How it works.
Challenge: A small proof-of-work page the SDK serves instead of your app, where it can. A real browser passes it in well under a second and carries on. See Challenge.
Credential stuffing: Trying stolen username and password pairs against a login, in bulk. See Credential stuffing.
CVE exploit scan: Probing an app for known, published vulnerabilities. See CVE exploit scans.
Event: The one redacted record an SDK sends for each request. Events are what the analyst reviews and what your plan counts. See Security.
Fail open: If camada is down or the SDK fails, your app keeps serving. See Security.
Project key: The CAMADA_KEY your SDK reads from the environment. It is shown once, when you create the project. See Docs.
Rogue AI agent: An AI agent that acts like an attacker. It is judged by the same evidence as any other attacker: what it requests and how. See AI agent abuse.
Rule: A condition on traffic and what to do when it matches: block, challenge, alert or ignore. See Rules and list entries.
Scraping: Collecting a site’s content in bulk, usually spread across many addresses to stay under per-address limits. See Scraping.
TLS fingerprint: A signature of how a client sets up its encrypted connection. Many addresses sharing one fingerprint can point to one tool. See Rules and list entries.
track(): The SDK call that reports login failures, signups and checkout declines, the outcomes only your app knows. The identifier is HMAC-hashed in your process. See Docs.
Verdict: What the analyst decides about a client, with the requests behind it and the reason why. See How it works.
Verified crawler: A search crawler, like Googlebot, confirmed to be who it says it is. Verified crawlers get through.
Watchkeeper: camada’s AI analyst. Every few minutes it reviews your traffic and writes a verdict on each client that looks wrong. See How it works.
x-rid: A response header the SDK adds. Seeing it on your responses means the key reached your app and the SDK is running. See Docs.