Skip to content

SAFE-106Beside the path

Intent segmentation

Checks whether an agent is treated more strictly at checkout than on the product page — letting agents browse while guarding the money step.

What we check

An active safety probe in the owner-requested safety test. We send two read-only GETs with a spoofed agent user-agent — one to a product page, one to checkout — and compare how each is treated.

Why it matters

The ideal posture is neither "block all agents" nor "allow all agents", but to let them read product information (which drives sales) while applying stricter controls at checkout (where fraud concentrates). This checks that your defences distinguish the two.

How we check

PASS: the checkout challenged or blocked the agent persona while the product page did not — the money step is guarded, browsing is not. FAIL (MEDIUM): the product page and checkout treated the agent identically (both open or both blocked), so there is no segmentation. SKIPPED: a product page and a checkout URL were not both available, or one could not be read. Two read-only GETs.

How to fix it

  1. Apply stricter bot controls on cart and checkout than on product and category pages.
  2. Allow agents to read product data freely so they can recommend and compare your items.
  3. Reserve challenges for the payment step and other sensitive actions rather than the whole site.

What good looks like

Same agent persona, two routes:

GET /products/anvil   (agent UA) -> 200, full page
GET /checkout         (agent UA) -> managed challenge

Browsing is open; checkout is guarded.

Sources