---
title: "camada glossary: bad actors, verdicts, blocklists and more"
description: "The terms camada uses, in plain words: bad actor, Watchkeeper, verdict, blocklist, challenge, fail open, credential stuffing, TLS fingerprint and more."
url: https://www.camada.app/glossary
last_updated: 2026-11-02
---

Glossary

# camada glossary

**Allow-list**

Clients you have said to let through. An allow-list entry always wins over a block, wherever the two overlap. See [Rules and list entries](https://www.camada.app/docs/rules).

**Bad actor**

Anyone abusing your app, whatever they run on: attackers using AI, AI agents that act like attackers, credential stuffers, scrapers and CVE exploit scanners. Customers and verified search crawlers are not bad actors.

**Beacon**

An optional addition to your HTML pages. It cuts false positives by showing which sessions are real browsers. See [Docs](https://www.camada.app/docs).

**Blocklist**

The clients your app refuses. The SDK holds it and checks each request against it, so enforcement never waits for a model. You can see each entry and its reason in the app. See [How it works](https://www.camada.app/how-it-works).

**Challenge**

A small proof-of-work page the SDK serves instead of your app, where it can. A real browser passes it in well under a second and carries on. See [Challenge](https://www.camada.app/docs/challenge).

**Credential stuffing**

Trying stolen username and password pairs against a login, in bulk. See [Credential stuffing](https://www.camada.app/use-cases/credential-stuffing).

**CVE exploit scan**

Probing an app for known, published vulnerabilities. See [CVE exploit scans](https://www.camada.app/use-cases/cve-exploits).

**Event**

The one redacted record an SDK sends for each request. Events are what the analyst reviews and what your plan counts. See [Security](https://www.camada.app/security).

**Fail open**

If camada is down or the SDK fails, your app keeps serving. See [Security](https://www.camada.app/security).

**Project key**

The CAMADA_KEY your SDK reads from the environment. It is shown once, when you create the project. See [Docs](https://www.camada.app/docs).

**Rogue AI agent**

An AI agent that acts like an attacker. It is judged by the same evidence as any other attacker: what it requests and how. See [AI agent abuse](https://www.camada.app/use-cases/ai-agents).

**Rule**

A condition on traffic and what to do when it matches: block, challenge, alert or ignore. See [Rules and list entries](https://www.camada.app/docs/rules).

**Scraping**

Collecting a site’s content in bulk, usually spread across many addresses to stay under per-address limits. See [Scraping](https://www.camada.app/use-cases/scraping).

**TLS fingerprint**

A signature of how a client sets up its encrypted connection. Many addresses sharing one fingerprint can point to one tool. See [Rules and list entries](https://www.camada.app/docs/rules).

**track()**

The SDK call that reports login failures, signups and checkout declines, the outcomes only your app knows. The identifier is HMAC-hashed in your process. See [Docs](https://www.camada.app/docs).

**Verdict**

What the analyst decides about a client, with the requests behind it and the reason why. See [How it works](https://www.camada.app/how-it-works).

**Verified crawler**

A search crawler, like Googlebot, confirmed to be who it says it is. Verified crawlers get through.

**Watchkeeper**

camada’s AI analyst. Every few minutes it reviews your traffic and writes a verdict on each client that looks wrong. See [How it works](https://www.camada.app/how-it-works).

**x-rid**

A response header the SDK adds. Seeing it on your responses means the key reached your app and the SDK is running. See [Docs](https://www.camada.app/docs).

## Sitemap

[Every page on this site](https://www.camada.app/sitemap.md)