diff --git a/pkg/acquisition/modules/appsec/config.go b/pkg/acquisition/modules/appsec/config.go
index f92962790fb..31d043aae42 100644
--- a/pkg/acquisition/modules/appsec/config.go
+++ b/pkg/acquisition/modules/appsec/config.go
@@ -130,9 +130,9 @@ func loadCertPool(caCertPath string, logger log.FieldLogger) (*x509.CertPool, er
 }
 
 // expandAppsecConfigEntry resolves a single appsec_config(s) entry into the list
-// of appsec-config item names to load. A literal entry is returned untouched. An entry containing a glob meta-character 
-// is matched against the installed appsec-configs with the same matcher used
-// to expand appsec-rule patterns; it errors when no installed config matches.
+// of appsec-config item names to load. A literal entry is returned untouched.
+// An entry containing a glob meta-character is matched against the installed appsec-configs,
+// errors when no installed config matches.
 func expandAppsecConfigEntry(entry string, hub *cwhub.Hub) ([]string, error) {
 	if !strings.ContainsAny(entry, "*?") {
 		return []string{entry}, nil
@@ -281,6 +281,11 @@ func (w *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.E
 			return fmt.Errorf("unable to build challenge options: %w", err)
 		}
 
+		// cwhub manages the script.
+		if customJS := appsecCfg.LoadCustomJS(w.hub.GetDataDir()); customJS != "" {
+			challengeOpts = append(challengeOpts, challenge.WithCustomJS(customJS))
+		}
+
 		challengeRuntime, err := challenge.NewChallengeRuntime(ctx, challengeOpts...)
 		if err != nil {
 			return fmt.Errorf("unable to create challenge runtime: %w", err)
diff --git a/pkg/appsec/appsec.go b/pkg/appsec/appsec.go
index a6be3141528..c64f91252e5 100644
--- a/pkg/appsec/appsec.go
+++ b/pkg/appsec/appsec.go
@@ -1275,6 +1275,19 @@ func (w *AppsecRuntimeConfig) ProcessOnChallengeRules(ctx context.Context, state
 			map[string]string{"Content-Type": "application/javascript", "Cache-Control": "public, max-age=3600"}, nil)
 	}
 
+	// Unreferenced when no appsec-config shipped a script, so the path then
+	// falls through to normal request handling.
+	//
+	// Never cached: the script changes whenever an operator changes the shipped
+	// detections, and a returning visitor running old detections against new
+	// scoring rules would be silent.
+	if path == challenge.ChallengeCustomJSPath {
+		if customJS := w.ChallengeRuntime.CustomJS(); customJS != "" {
+			return w.setChallengeResponse(state, http.StatusOK, customJS,
+				map[string]string{"Content-Type": "application/javascript", "Cache-Control": "no-cache, no-store"}, nil)
+		}
+	}
+
 	// Challenge submission: validate, give on_challenge_submit hooks a chance
 	// to reject the submission, then issue (or deny) the cookie. Per-route
 	// on_challenge inspection happens on subsequent cookie-bearing requests.
diff --git a/pkg/appsec/challenge/challenge.go b/pkg/appsec/challenge/challenge.go
index 03a1884009e..c930e97fd97 100644
--- a/pkg/appsec/challenge/challenge.go
+++ b/pkg/appsec/challenge/challenge.go
@@ -31,6 +31,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"text/template"
 	"time"
 
@@ -52,6 +53,8 @@ const (
 	ChallengeSubmitPath    = "/crowdsec-internal/challenge/submit"
 	ChallengePowWorkerPath = "/crowdsec-internal/challenge/pow-worker.js"
 	ChallengeFPScannerPath = "/crowdsec-internal/challenge/fpscanner.js"
+	// ChallengeCustomJSPath serves the custom detection script; see WithCustomJS.
+	ChallengeCustomJSPath = "/crowdsec-internal/challenge/custom.js"
 )
 
 // Sentinel errors (reasons) returned by ValidateChallengeResponse.
@@ -78,11 +81,17 @@ const cryptoObfuscationPoolDefaultSize = 1
 // outlive the per-epoch signing window without widening forgery exposure.
 const defaultCookieTTL = 12 * time.Hour
 
+// DefaultCustomJSTimeout is the wall-clock all detection hooks share when
+// custom_js_timeout is unset. It is time the visitor spends on the challenge
+// page, so it is deliberately short.
+const DefaultCustomJSTimeout = 500 * time.Millisecond
+
 // DefaultChallengeCSP is the Content-Security-Policy header used on the
 // challenge page when the operator hasn't configured a custom one. Allows
-// inline script/style (the challenge runtime injects both) and blob workers
-// (the PoW worker is loaded from a blob URL).
-const DefaultChallengeCSP = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; worker-src 'self' blob:;"
+// inline script/style (the challenge runtime injects both), blob workers
+// (the PoW worker is loaded from a blob URL) and WebAssembly compilation
+// (hub-shipped detection modules can use it).
+const DefaultChallengeCSP = "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; worker-src 'self' blob:;"
 
 //go:embed challenge.html.tmpl
 var htmlTemplate string
@@ -125,6 +134,23 @@ type ChallengeRuntime struct {
 	// dynamic_module.go.
 	challengeCode string
 
+	// customJS is the concatenated detection script shipped through the hub.
+	customJS string
+
+	// customJSTimeout is the budget those hooks share, sent to the browser on
+	// each challenge page.
+	customJSTimeout time.Duration
+
+	// customJSVersion is a digest of customJS. It is reported at startup so an
+	// operator can tell which build of the shipped detections an engine is
+	// actually running; it is not part of the script URL.
+	customJSVersion string
+
+	// customOverflowWarned latches the first cookie-overflow warning. Overflow is
+	// a property of the deployment (a detector reporting too much), not of the
+	// visitor, so warning per submission repeats it for every visitor.
+	customOverflowWarned atomic.Bool
+
 	powDifficulty int
 
 	// keys derives per-epoch sign keys (per-challenge secret / PoW MAC HMACs)
@@ -183,12 +209,29 @@ type runtimeOptions struct {
 	maxCookieLen              int
 	cryptoObfuscationPoolSize int
 	spentSetMaxEntries        int
+	customJS                  string
+	customJSTimeout           time.Duration
 	logger                    *log.Entry // nil → default "challenge" sublogger
 	// skipPreWarm drops the constructor's synchronous obfuscation and the
 	// background pre-warmer. Only withoutPreWarm (challenge_test.go) sets it.
 	skipPreWarm bool
 }
 
+// WithCustomJS sets the hub-distributed detection script. Empty disables it.
+func WithCustomJS(src string) Option {
+	return func(o *runtimeOptions) {
+		o.customJS = src
+	}
+}
+
+// WithCustomJSTimeout sets the shared detection-hook budget; zero or negative
+// is ignored, leaving DefaultCustomJSTimeout.
+func WithCustomJSTimeout(d time.Duration) Option {
+	return func(o *runtimeOptions) {
+		o.customJSTimeout = d
+	}
+}
+
 func WithLogger(logger *log.Entry) Option {
 	return func(o *runtimeOptions) {
 		o.logger = logger
@@ -426,6 +469,11 @@ func NewChallengeRuntime(ctx context.Context, opts ...Option) (*ChallengeRuntime
 		cookieTTL = defaultCookieTTL
 	}
 
+	customJSTimeout := resolvedOpts.customJSTimeout
+	if customJSTimeout <= 0 {
+		customJSTimeout = DefaultCustomJSTimeout
+	}
+
 	maxCookieLen := resolvedOpts.maxCookieLen
 	if maxCookieLen <= 0 {
 		maxCookieLen = MaxCookieLen
@@ -476,9 +524,12 @@ func NewChallengeRuntime(ctx context.Context, opts ...Option) (*ChallengeRuntime
 		maxCookieLen:       maxCookieLen,
 		htmlTpl:            htmlTpl,
 		spent:              newSpentSet(spentSetMaxEntries),
+		customJSTimeout:    customJSTimeout,
 		logger:             logger,
 	}
 
+	challengeRuntime.setCustomJS(resolvedOpts.customJS)
+
 	// Load the build-time-obfuscated challenge code from the baked-in bundle so
 	// we can serve immediately.
 	if err := challengeRuntime.seedCacheFromInitialBundle(); err != nil {
@@ -505,13 +556,22 @@ func NewChallengeRuntime(ctx context.Context, opts ...Option) (*ChallengeRuntime
 		go challengeRuntime.dynamicModulePreWarmer(runCtx)
 	}
 
-	logger.WithFields(log.Fields{
+	fields := log.Fields{
 		"rotation_interval": rotationInterval,
 		"cookie_ttl":        cookieTTL,
 		"max_cookie_len":    maxCookieLen,
 		"pow_difficulty":    defaultPowDifficulty,
 		"crypto_pool_size":  cryptoPoolSize,
-	}).Info("WAF challenge runtime initialized")
+	}
+
+	// Only with a script loaded: the timeout bounds nothing without hooks, and an
+	// empty version on every challenge-mode startup reads as a failed load.
+	if challengeRuntime.customJS != "" {
+		fields["custom_js_version"] = challengeRuntime.customJSVersion
+		fields["custom_js_timeout"] = customJSTimeout
+	}
+
+	logger.WithFields(fields).Info("WAF challenge runtime initialized")
 
 	return challengeRuntime, nil
 }
@@ -585,17 +645,26 @@ func (c *ChallengeRuntime) GetChallengePage(ctx context.Context, userAgent strin
 		return "", fmt.Errorf("build dynamic key module: %w", err)
 	}
 
+	// Empty drops the script tag, rather than pointing every challenge page at
+	// an empty file.
+	customJSPath := ""
+	if c.customJS != "" {
+		customJSPath = ChallengeCustomJSPath
+	}
+
 	var renderedPage strings.Builder
 
 	if err := c.htmlTpl.Execute(&renderedPage, map[string]interface{}{
-		"JSChallenge":   challengeCode,
-		"DynamicModule": dynamicModule,
-		"FPScannerPath": ChallengeFPScannerPath,
-		"PowDifficulty": difficulty,
-		"PowPrefix":     powSalt,
-		"PowMAC":        powMAC,
-		"Timestamp":     ts,
-		"R":             r,
+		"JSChallenge":       challengeCode,
+		"DynamicModule":     dynamicModule,
+		"FPScannerPath":     ChallengeFPScannerPath,
+		"CustomJSPath":      customJSPath,
+		"CustomJSTimeoutMS": c.customJSTimeout.Milliseconds(),
+		"PowDifficulty":     difficulty,
+		"PowPrefix":         powSalt,
+		"PowMAC":            powMAC,
+		"Timestamp":         ts,
+		"R":                 r,
 	}); err != nil {
 		return "", fmt.Errorf("render challenge page: %w", err)
 	}
@@ -705,6 +774,7 @@ func (c *ChallengeRuntime) ValidateChallengeResponse(request *http.Request, body
 			"k_epoch": fmt.Sprintf("%x", signKey),
 			"fsid":    fpData.FSID,
 			"is_bot":  fpData.FastBotDetection,
+			"custom":  fpData.CustomKeys(),
 		}).Debug("validated submission")
 	}
 
@@ -721,6 +791,15 @@ func (c *ChallengeRuntime) ValidateChallengeResponse(request *http.Request, body
 	// rotation); the browser Max-Age below matches so both expire together.
 	notAfter := time.Now().Add(c.cookieTTL).Unix()
 	cookieValue, err := sealCookieV0(envelope, c.keys.MasterCookieKey(), notAfter, 0, "", []byte(request.UserAgent()), c.maxCookieLen)
+
+	// If the cookie is too large, try to drop custom detection as a last chance to fit it within the size limit.
+	if errors.Is(err, ErrCookieTooLarge) && envelope.GetFingerprint().GetCustom() != nil {
+		c.logCustomOverflow(&fpData)
+
+		envelope.Fingerprint.Custom = nil
+		cookieValue, err = sealCookieV0(envelope, c.keys.MasterCookieKey(), notAfter, 0, "", []byte(request.UserAgent()), c.maxCookieLen)
+	}
+
 	if err != nil {
 		return nil, FingerprintData{}, 0, fmt.Errorf("failed to seal challenge cookie: %w", err)
 	}
@@ -794,3 +873,36 @@ func (c *ChallengeRuntime) ValidCookie(ck *http.Cookie, userAgent string) (*Cook
 		AllowlistReason: envelope.AllowlistReason,
 	}, nil
 }
+
+// setCustomJS keeps the script and the digest reported for it in step.
+func (c *ChallengeRuntime) setCustomJS(src string) {
+	c.customJS = src
+	c.customJSVersion = CustomJSVersion(src)
+}
+
+// CustomJS returns the detection script the dispatcher serves at
+// ChallengeCustomJSPath, empty when none is loaded.
+func (c *ChallengeRuntime) CustomJS() string {
+	if c == nil {
+		return ""
+	}
+
+	return c.customJS
+}
+
+// logCustomOverflow reports a dropped custom map. The first one is the operator's
+// signal; the rest are the same deployment fact repeated once per visitor, so they
+// go to debug. CustomKeys allocates, hence the level check.
+func (c *ChallengeRuntime) logCustomOverflow(fpData *FingerprintData) {
+	const msg = "custom detections do not fit in the cookie, dropped"
+
+	if c.customOverflowWarned.CompareAndSwap(false, true) {
+		c.log().WithField("custom", fpData.CustomKeys()).Warn(msg)
+
+		return
+	}
+
+	if c.log().Logger.IsLevelEnabled(log.DebugLevel) {
+		c.log().WithField("custom", fpData.CustomKeys()).Debug(msg)
+	}
+}
diff --git a/pkg/appsec/challenge/challenge.html.tmpl b/pkg/appsec/challenge/challenge.html.tmpl
index 729ec556588..2e9c91c77d4 100644
--- a/pkg/appsec/challenge/challenge.html.tmpl
+++ b/pkg/appsec/challenge/challenge.html.tmpl
@@ -388,10 +388,13 @@
       })();
     </script>
 
-    <script>var _powD={{.PowDifficulty}},_powP="{{.PowPrefix}}",_powM="{{.PowMAC}}",_ts="{{.Timestamp}}",_r="{{.R}}"</script>
+    <script>var _powD={{.PowDifficulty}},_powP="{{.PowPrefix}}",_powM="{{.PowMAC}}",_ts="{{.Timestamp}}",_r="{{.R}}",_cjsT={{.CustomJSTimeoutMS}}</script>
     <!-- Classic script: runs before the deferred module below, so the scanner
          global is ready when the challenge code runs. -->
     <script src="{{.FPScannerPath}}"></script>
+    {{if .CustomJSPath}}<!-- Classic script like the scanner, so the hooks are
+         registered before the module below runs them. -->
+    <script src="{{.CustomJSPath}}"></script>{{end}}
     <script type="module">
 {{.JSChallenge}}
 {{.DynamicModule}}
diff --git a/pkg/appsec/challenge/challenge.js b/pkg/appsec/challenge/challenge.js
index 93f0f4d0167..0a1c879d348 100644
--- a/pkg/appsec/challenge/challenge.js
+++ b/pkg/appsec/challenge/challenge.js
@@ -383,6 +383,55 @@ function reportChallengeStatus(status) {
 
 const CSEC_HOOK_NAME = "__CSEC_CHALLENGE_HOOK_v1__";
 
+// --- Custom detections ---
+// Hub-shipped scripts push a function onto this global; each may mutate the
+// collected fingerprint to clear an fpscanner false positive or add fp.custom
+// entries for appsec-rules to score. reservedStrings in
+// js/obfuscate/obfuscate.js keeps the name literal, so the separately-built
+// bundles agree on the symbol.
+const CSEC_CUSTOM_NAME = "__CSEC_CUSTOM_DETECT_v1__";
+
+// Budget for all hooks combined: the visitor is watching a spinner, so one that
+// hangs must not hold them there. Injected per request from custom_js_timeout;
+// the fallback matches DefaultCustomJSTimeout.
+const CSEC_CUSTOM_BUDGET_MS = typeof _cjsT !== "undefined" ? _cjsT : 500;
+
+// Each hook is isolated — a throw, rejection or timeout drops only its own
+// effect, so a broken script cannot cost a visitor the page.
+async function applyCustomDetections(fp) {
+  const hooks = globalThis[CSEC_CUSTOM_NAME];
+  if (!Array.isArray(hooks) || hooks.length === 0) {
+    return;
+  }
+
+  const deadline = new Promise((resolve) =>
+    setTimeout(resolve, CSEC_CUSTOM_BUDGET_MS),
+  );
+
+  for (const hook of hooks) {
+    if (typeof hook !== "function") {
+      continue;
+    }
+    try {
+      await Promise.race([Promise.resolve(hook(fp)), deadline]);
+    } catch (_) {
+      // Deliberately swallowed; see above.
+    }
+  }
+
+  // collectFingerprint set this before the hooks ran, so a cleared detection
+  // would otherwise leave the summary flag stuck on. fsid is left alone: it
+  // hashes the pre-hook bitmask, which keeps ids comparable between
+  // deployments running different scripts.
+  try {
+    fp.fastBotDetection = Object.values(fp.fastBotDetectionDetails).some(
+      (d) => d && d.detected,
+    );
+  } catch (_) {
+    // Malformed details; leave the flag as fpscanner set it.
+  }
+}
+
 async function runChallenge(epochKey) {
   // Fail closed if the fpscanner bundle didn't load.
   const Scanner = globalThis.CrowdsecFingerprintScanner;
@@ -405,6 +454,9 @@ async function runChallenge(epochKey) {
     return;
   }
 
+  // Runs before anything is signed, so hooks can still correct fpscanner.
+  await applyCustomDetections(fpResult);
+
   // Per-challenge secret s = HMAC(K_epoch, r). Never transmitted; the server
   // derives the same s from its per-epoch key and the cleartext r. epochKey is
   // hex-encoded K; HMAC over its raw bytes.
diff --git a/pkg/appsec/challenge/challenge_test.go b/pkg/appsec/challenge/challenge_test.go
index 23593841024..292aa7d514f 100644
--- a/pkg/appsec/challenge/challenge_test.go
+++ b/pkg/appsec/challenge/challenge_test.go
@@ -785,3 +785,28 @@ func TestChallengePageChecksCookiesEnabled(t *testing.T) {
 		require.Contains(t, htmlTemplate, want)
 	}
 }
+
+// The default CSP has to permit WebAssembly, because hub-shipped detection
+// modules compile a module to read CPU-level behavior. It must NOT permit
+// JavaScript eval: some automation frameworks inject their spoofing that way
+// and this policy is what refuses them, so the two tokens are not
+// interchangeable even though one contains the other as a substring.
+func TestDefaultChallengeCSP(t *testing.T) {
+	tests := []struct {
+		name  string
+		token string
+		want  bool
+	}{
+		{"allows wasm compilation", "'wasm-unsafe-eval'", true},
+		{"still forbids js eval", " 'unsafe-eval'", false},
+		{"keeps inline script", "'unsafe-inline'", true},
+		{"keeps blob workers", "worker-src 'self' blob:", true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			require.Equal(t, tc.want, strings.Contains(DefaultChallengeCSP, tc.token),
+				"token %q in %q", tc.token, DefaultChallengeCSP)
+		})
+	}
+}
diff --git a/pkg/appsec/challenge/config.go b/pkg/appsec/challenge/config.go
index 9890bd24bc9..3b01fbf6313 100644
--- a/pkg/appsec/challenge/config.go
+++ b/pkg/appsec/challenge/config.go
@@ -42,6 +42,11 @@ type Config struct {
 	// per-epoch keys rotate tightly. Defaults to 12h.
 	CookieTTL *time.Duration `yaml:"cookie_ttl"`
 
+	// CustomJSTimeout bounds the time all CUSTOM_JS detection hooks get, in
+	// total rather than each.
+	// Defaults to DefaultCustomJSTimeout.
+	CustomJSTimeout *time.Duration `yaml:"custom_js_timeout"`
+
 	// MaxCookieSize caps the challenge cookie's encoded size, enforced on both
 	// seal and open. It bounds the memory allocated from the (attacker-supplied)
 	// fingerprint envelope, closing an over-allocation DoS. Defaults to
@@ -84,6 +89,9 @@ func (c *Config) MergeFrom(other *Config) {
 	if other.CookieTTL != nil {
 		c.CookieTTL = other.CookieTTL
 	}
+	if other.CustomJSTimeout != nil {
+		c.CustomJSTimeout = other.CustomJSTimeout
+	}
 	if other.MaxCookieSize != nil {
 		c.MaxCookieSize = other.MaxCookieSize
 	}
@@ -137,6 +145,9 @@ func BuildOptions(c *Config, parent *log.Entry) ([]Option, error) {
 	if c.CookieTTL != nil {
 		opts = append(opts, WithCookieTTL(*c.CookieTTL))
 	}
+	if c.CustomJSTimeout != nil {
+		opts = append(opts, WithCustomJSTimeout(*c.CustomJSTimeout))
+	}
 	if c.MaxCookieSize != nil && *c.MaxCookieSize > 0 {
 		opts = append(opts, WithMaxCookieLen(*c.MaxCookieSize))
 	}
diff --git a/pkg/appsec/challenge/customjs_assemble.go b/pkg/appsec/challenge/customjs_assemble.go
new file mode 100644
index 00000000000..45212c0791b
--- /dev/null
+++ b/pkg/appsec/challenge/customjs_assemble.go
@@ -0,0 +1,230 @@
+// customjs_assemble.go compiles the detection modules an appsec-config ships
+// through the hub into the script served at ChallengeCustomJSPath.
+//
+// Each module is built and wrapped in its own IIFE, to limit blast zone if a
+// detector fails to parse etc.
+
+package challenge
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+
+	esbuildapi "github.com/evanw/esbuild/pkg/api"
+)
+
+// customDetectGlobal is the array challenge.js drains after fpscanner runs.
+const customDetectGlobal = "__CSEC_CUSTOM_DETECT_v1__"
+
+// customDetectExport is the one symbol a detection module has to expose.
+const customDetectExport = "collectSignals"
+
+const (
+	// detectorNamespace keeps every module out of esbuild's "file" namespace
+	detectorNamespace = "csdet"
+
+	// detectorSpecifier is a fixed literal rather than the dest_file
+	detectorSpecifier = detectorNamespace + ":d"
+)
+
+// moduleMarker forces esbuild to read the file as an ES module. Without an
+// import or export of its own a file is taken for CommonJS, and asking it for a
+// named export then yields undefined instead of an error.
+const moduleMarker = "\n;export {};\n"
+
+// safeDetectorName bounds what can reach esbuild's module path, which with
+// minification off is echoed into the output as a `// csdet:<name>` comment.
+var safeDetectorName = regexp.MustCompile(`^[A-Za-z0-9._/-]+$`)
+
+// Detector is one hub-shipped detection module. Name is the dest_file it was
+// installed as, and is what build diagnostics are attributed to.
+type Detector struct {
+	Name   string
+	Source string
+}
+
+// DetectorError names a detector that was dropped, and why.
+type DetectorError struct {
+	Name string
+	Err  error
+}
+
+func (e DetectorError) Error() string {
+	return fmt.Sprintf("custom detection %s: %s", e.Name, e.Err)
+}
+
+func (e DetectorError) Unwrap() error {
+	return e.Err
+}
+
+// AssembleCustomJS compiles each detector in slice,
+// rejected holds the rest.
+func AssembleCustomJS(detectors []Detector) (string, []DetectorError) {
+	var (
+		fragments []string
+		rejected  []DetectorError
+	)
+
+	for _, d := range detectors {
+		fragment, err := buildDetector(d)
+		if err != nil {
+			rejected = append(rejected, DetectorError{Name: d.Name, Err: err})
+			continue
+		}
+
+		fragments = append(fragments, fragment)
+	}
+
+	return strings.Join(fragments, ""), rejected
+}
+
+// CustomJSVersion digests the assembled script so startup logs can identify
+// which build is live. Truncated: it only has to change when the bytes do, it
+// is not an integrity check.
+func CustomJSVersion(src string) string {
+	if src == "" {
+		return ""
+	}
+
+	sum := sha256.Sum256([]byte(src))
+
+	return hex.EncodeToString(sum[:4])
+}
+
+// buildDetector turns one ES module into a self-registering IIFE (self-executing function wrapper)
+func buildDetector(d Detector) (string, error) {
+	if !safeDetectorName.MatchString(d.Name) {
+		return "", fmt.Errorf("unusable dest_file %q: expected only letters, digits and %q", d.Name, "._/-")
+	}
+
+	result := esbuildapi.Build(esbuildapi.BuildOptions{
+		Stdin: &esbuildapi.StdinOptions{
+			Contents: detectorEntry(),
+			Loader:   esbuildapi.LoaderJS,
+			// ResolveDir stays empty: the plugin answers every specifier.
+		},
+		Plugins: []esbuildapi.Plugin{detectorFS(d)},
+		Bundle:  true,
+		Write:   false,
+		Format:  esbuildapi.FormatIIFE,
+		// A detector that throws while loading must not break the rest.
+		Banner:   map[string]string{"js": "try{"},
+		Footer:   map[string]string{"js": "}catch(e){}\n"},
+		Platform: esbuildapi.PlatformBrowser,
+		Target:   esbuildapi.ES2022,
+		// we remove all minification and such in case we need to do some weird js sheningans
+		TreeShaking: esbuildapi.TreeShakingFalse,
+		Sourcemap:   esbuildapi.SourceMapNone,
+		LogLevel:    esbuildapi.LogLevelSilent,
+		LogLimit:    10,
+	})
+
+	if len(result.Errors) > 0 {
+		return "", buildError(d.Name, result.Errors)
+	}
+
+	if len(result.OutputFiles) == 0 {
+		return "", errors.New("esbuild returned no output")
+	}
+
+	return string(result.OutputFiles[0].Contents), nil
+}
+
+// detectorEntry registers the module's export. It mirrors the consumer's own
+// guard in challenge.js, so junk left on the global cannot make push throw.
+func detectorEntry() string {
+	return fmt.Sprintf(`import { %s } from %q;
+
+(function () {
+  var g = globalThis;
+  var h = g.%s;
+  if (!Array.isArray(h)) {
+    h = g.%s = [];
+  }
+  h.push(%s);
+})();
+`, customDetectExport, detectorSpecifier, customDetectGlobal, customDetectGlobal, customDetectExport)
+}
+
+// detectorFS serves the module from memory and refuses everything else, so a
+// detector cannot pull in a second file, an npm package, or anything on disk.
+func detectorFS(d Detector) esbuildapi.Plugin {
+	return esbuildapi.Plugin{
+		Name: "crowdsec-custom-detections",
+		Setup: func(b esbuildapi.PluginBuild) {
+			// Registered first: esbuild runs OnResolve callbacks in order and
+			// stops at the one that returns a path.
+			b.OnResolve(esbuildapi.OnResolveOptions{Filter: `^` + detectorNamespace + `:`},
+				func(args esbuildapi.OnResolveArgs) (esbuildapi.OnResolveResult, error) {
+					// Namespace is the importer's, so this is the module trying
+					// to reach the internal scheme rather than the entry.
+					if args.Namespace == detectorNamespace {
+						return rejectImport(args), nil
+					}
+
+					// Resolving to the dest_file rather than the specifier is
+					// what makes esbuild report errors against the file the
+					// operator installed.
+					return esbuildapi.OnResolveResult{Path: d.Name, Namespace: detectorNamespace}, nil
+				})
+
+			b.OnResolve(esbuildapi.OnResolveOptions{Filter: `.*`},
+				func(args esbuildapi.OnResolveArgs) (esbuildapi.OnResolveResult, error) {
+					return rejectImport(args), nil
+				})
+
+			b.OnLoad(esbuildapi.OnLoadOptions{Filter: `.*`, Namespace: detectorNamespace},
+				func(_ esbuildapi.OnLoadArgs) (esbuildapi.OnLoadResult, error) {
+					src := d.Source + moduleMarker
+					return esbuildapi.OnLoadResult{Contents: &src, Loader: esbuildapi.LoaderJS}, nil
+				})
+		},
+	}
+}
+
+// rejectImport leaves Location nil so esbuild fills in the import site, which
+// points the operator at the offending line rather than at the entry.
+func rejectImport(args esbuildapi.OnResolveArgs) esbuildapi.OnResolveResult {
+	return esbuildapi.OnResolveResult{Errors: []esbuildapi.Message{{
+		Text: fmt.Sprintf("cannot import %q: a detection module must be self-contained", args.Path),
+	}}}
+}
+
+// buildError turns esbuild diagnostics into one line an operator can act on.
+func buildError(name string, msgs []esbuildapi.Message) error {
+	parts := make([]string, 0, len(msgs))
+
+	for _, msg := range msgs {
+		parts = append(parts, formatBuildMessage(name, msg))
+	}
+
+	return errors.New(strings.Join(parts, "; "))
+}
+
+func formatBuildMessage(name string, msg esbuildapi.Message) string {
+	text := msg.Text
+
+	// esbuild's own wording for this names the internal specifier and reads as
+	// a bundler problem, which is not what the author needs to hear.
+	if strings.Contains(text, "No matching export") && strings.Contains(text, customDetectExport) {
+		text = fmt.Sprintf("must export a function named %s (see custom_js.md)", customDetectExport)
+	}
+
+	loc := msg.Location
+	if loc == nil {
+		return text
+	}
+
+	// The location is reported in the virtual namespace; the operator knows the
+	// file by its dest_file.
+	file := strings.TrimPrefix(loc.File, detectorNamespace+":")
+	if file == "" || file == "<stdin>" {
+		file = name
+	}
+
+	return fmt.Sprintf("%s:%d:%d: %s", file, loc.Line, loc.Column, text)
+}
diff --git a/pkg/appsec/challenge/customjs_assemble_test.go b/pkg/appsec/challenge/customjs_assemble_test.go
new file mode 100644
index 00000000000..4ed87fa7888
--- /dev/null
+++ b/pkg/appsec/challenge/customjs_assemble_test.go
@@ -0,0 +1,295 @@
+package challenge
+
+import (
+	"crypto/sha256"
+	"strings"
+	"testing"
+
+	esbuildapi "github.com/evanw/esbuild/pkg/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// detector builds a module that reports one marker value, so a test can tell
+// whose code ended up in the output.
+func detector(name, marker string) Detector {
+	return Detector{
+		Name:   name,
+		Source: "export function " + customDetectExport + "(fp) { fp.custom = fp.custom || {}; fp.custom.x = \"" + marker + "\"; }\n",
+	}
+}
+
+// requireParses is the collision test as much as a sanity check: concatenating
+// two modules that both declare `const CFG` is an early SyntaxError, so an
+// assembly that still parses proves the scopes were separated.
+func requireParses(t *testing.T, src string) {
+	t.Helper()
+
+	result := esbuildapi.Transform(src, esbuildapi.TransformOptions{Target: esbuildapi.ES2022})
+	require.Empty(t, result.Errors, "assembled output does not parse")
+}
+
+// The Go constant has to agree with challenge.js and obfuscate.js like the
+// others; see the comment on customSentinel.
+func TestAssembleUsesTheSharedSentinel(t *testing.T) {
+	assert.Equal(t, customSentinel, customDetectGlobal)
+}
+
+func TestAssembleCustomJS(t *testing.T) {
+	tests := []struct {
+		name      string
+		detectors []Detector
+		wantOK    []string // markers expected in the output
+		wantRej   []string // dest_files expected to be rejected
+		wantErr   string   // substring the first rejection must contain
+	}{
+		{
+			name:      "single module",
+			detectors: []Detector{detector("challenge/a.js", "A")},
+			wantOK:    []string{"A"},
+		},
+		{
+			// The case that is an early SyntaxError today, taking every
+			// detector down with it.
+			name: "same top-level names in two modules",
+			detectors: []Detector{
+				{Name: "challenge/a.js", Source: "const CFG = \"A\";\nfunction helper() { return CFG }\nexport function collectSignals(fp) { fp.custom = { x: helper() } }\n"},
+				{Name: "challenge/b.js", Source: "const CFG = \"B\";\nfunction helper() { return CFG }\nexport function collectSignals(fp) { fp.custom.y = helper() }\n"},
+			},
+			wantOK: []string{"A", "B"},
+		},
+		{
+			name: "missing export is rejected, the rest still build",
+			detectors: []Detector{
+				{Name: "challenge/bad.js", Source: "function collectSignals(fp) {}\n"},
+				detector("challenge/good.js", "GOOD"),
+			},
+			wantOK:  []string{"GOOD"},
+			wantRej: []string{"challenge/bad.js"},
+			wantErr: customDetectExport,
+		},
+		{
+			// The regression test for the bug this replaces: one unparseable
+			// file used to cost every other detector its registration.
+			name: "syntax error is rejected, the rest still build",
+			detectors: []Detector{
+				{Name: "challenge/bad.js", Source: "export function collectSignals(fp) {\n"},
+				detector("challenge/good.js", "GOOD"),
+			},
+			wantOK:  []string{"GOOD"},
+			wantRej: []string{"challenge/bad.js"},
+			wantErr: "challenge/bad.js:",
+		},
+		{
+			name:      "relative import is rejected",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "import u from \"./util.js\";\nexport function collectSignals(fp) { u }\n"}},
+			wantRej:   []string{"challenge/a.js"},
+			wantErr:   "self-contained",
+		},
+		{
+			name:      "bare import is rejected",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "import \"lodash\";\nexport function collectSignals(fp) {}\n"}},
+			wantRej:   []string{"challenge/a.js"},
+			wantErr:   "self-contained",
+		},
+		{
+			name:      "dynamic import of a literal is rejected",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "export function collectSignals(fp) { import(\"./x.js\") }\n"}},
+			wantRej:   []string{"challenge/a.js"},
+			wantErr:   "self-contained",
+		},
+		{
+			name:      "require of a literal is rejected",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "export function collectSignals(fp) { require(\"x\") }\n"}},
+			wantRej:   []string{"challenge/a.js"},
+			wantErr:   "self-contained",
+		},
+		{
+			// The internal scheme is not a back door into the resolver.
+			name:      "importing the internal scheme is rejected",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "import \"" + detectorSpecifier + "\";\nexport function collectSignals(fp) {}\n"}},
+			wantRej:   []string{"challenge/a.js"},
+			wantErr:   "self-contained",
+		},
+		{
+			// Rejected at parse time only because the output format is IIFE;
+			// pins that the build format cannot drift.
+			name:      "top-level await is rejected",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "await 1;\nexport function collectSignals(fp) {}\n"}},
+			wantRej:   []string{"challenge/a.js"},
+			wantErr:   "await",
+		},
+		{
+			// dest_file is echoed into the output as a comment, so it may not
+			// carry anything that closes one.
+			name:      "unusable dest_file is rejected",
+			detectors: []Detector{detector("challenge/a.js\";evil();//", "A")},
+			wantRej:   []string{"challenge/a.js\";evil();//"},
+			wantErr:   "unusable dest_file",
+		},
+		{
+			name:      "every module rejected yields nothing",
+			detectors: []Detector{{Name: "challenge/a.js", Source: "syntax error(\n"}},
+			wantRej:   []string{"challenge/a.js"},
+		},
+		{
+			name: "no detectors",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			out, rejected := AssembleCustomJS(tc.detectors)
+
+			names := make([]string, 0, len(rejected))
+			for _, r := range rejected {
+				names = append(names, r.Name)
+			}
+
+			assert.Equal(t, tc.wantRej, nilIfEmpty(names))
+
+			if tc.wantErr != "" {
+				require.NotEmpty(t, rejected)
+				assert.Contains(t, rejected[0].Err.Error(), tc.wantErr)
+			}
+
+			if len(tc.wantOK) == 0 {
+				assert.Empty(t, out)
+				return
+			}
+
+			requireParses(t, out)
+			assert.Contains(t, out, customDetectGlobal)
+
+			for _, marker := range tc.wantOK {
+				assert.Contains(t, out, "\""+marker+"\"")
+			}
+		})
+	}
+}
+
+func nilIfEmpty(s []string) []string {
+	if len(s) == 0 {
+		return nil
+	}
+
+	return s
+}
+
+// A non-literal specifier never reaches the resolver, so esbuild only warns and
+// the call survives to throw in the browser. Pinned so nobody "fixes" it by
+// accident; documented in custom_js.md.
+func TestAssembleKeepsModuleWithNonLiteralImport(t *testing.T) {
+	out, rejected := AssembleCustomJS([]Detector{
+		{Name: "challenge/a.js", Source: "export function collectSignals(fp) { import(fp.where) }\n"},
+	})
+
+	assert.Empty(t, rejected)
+	assert.Contains(t, out, customDetectGlobal)
+}
+
+// A module that throws while loading must cost only its own registration.
+func TestAssembleIsolatesLoadTimeThrow(t *testing.T) {
+	out, rejected := AssembleCustomJS([]Detector{
+		{Name: "challenge/throws.js", Source: "throw new Error(\"boom\");\nexport function collectSignals(fp) {}\n"},
+		detector("challenge/good.js", "GOOD"),
+	})
+
+	require.Empty(t, rejected)
+	requireParses(t, out)
+
+	assert.Equal(t, 2, strings.Count(out, "try{"), "each module needs its own catch")
+	assert.Less(t, strings.Index(out, "boom"), strings.Index(out, "}catch(e){}"),
+		"the throw must sit inside the first module's catch")
+}
+
+func TestAssemblePreservesOrder(t *testing.T) {
+	out, rejected := AssembleCustomJS([]Detector{
+		detector("challenge/a.js", "FIRST"),
+		detector("challenge/b.js", "SECOND"),
+		detector("challenge/c.js", "THIRD"),
+	})
+
+	require.Empty(t, rejected)
+	assert.Less(t, strings.Index(out, "FIRST"), strings.Index(out, "SECOND"))
+	assert.Less(t, strings.Index(out, "SECOND"), strings.Index(out, "THIRD"))
+}
+
+// The output digest is the cache key on an hour-cached URL, so identical input
+// has to produce identical bytes across runs. Looped because esbuild parses on
+// several goroutines.
+func TestAssembleIsDeterministic(t *testing.T) {
+	detectors := []Detector{
+		detector("challenge/a.js", "A"),
+		detector("challenge/b.js", "B"),
+		detector("challenge/c.js", "C"),
+	}
+
+	want, rejected := AssembleCustomJS(detectors)
+	require.Empty(t, rejected)
+	require.NotEmpty(t, want)
+
+	wantSum := sha256.Sum256([]byte(want))
+
+	for range 20 {
+		got, _ := AssembleCustomJS(detectors)
+		require.Equal(t, want, got)
+		require.Equal(t, wantSum, sha256.Sum256([]byte(got)))
+	}
+}
+
+// fpscanner's CDP check needs console.log to keep its side effect; the same
+// goes for a hub detector. Guards against anyone adding Drop: DropConsole.
+func TestAssembleKeepsConsoleCalls(t *testing.T) {
+	out, rejected := AssembleCustomJS([]Detector{
+		{Name: "challenge/a.js", Source: "export function collectSignals(fp) { try { null.x } catch (e) { console.log(e) } }\n"},
+	})
+
+	require.Empty(t, rejected)
+	assert.Contains(t, out, "console.log")
+}
+
+// The response carries no charset, so anything non-ASCII has to be escaped or
+// the browser may decode it wrong.
+func TestAssembleOutputIsASCII(t *testing.T) {
+	out, rejected := AssembleCustomJS([]Detector{
+		{Name: "challenge/a.js", Source: "export function collectSignals(fp) { fp.custom = { s: \"café\" } }\n"},
+	})
+
+	require.Empty(t, rejected)
+
+	for i := range len(out) {
+		require.Less(t, out[i], byte(0x80), "non-ASCII byte at offset %d", i)
+	}
+}
+
+// The bundler's CommonJS interop helpers have no business in a detection
+// script; their presence would mean a module was misclassified.
+func TestAssembleLeaksNoBundlerRuntime(t *testing.T) {
+	out, rejected := AssembleCustomJS([]Detector{detector("challenge/a.js", "A")})
+
+	require.Empty(t, rejected)
+	assert.NotContains(t, out, "__toESM")
+	assert.NotContains(t, out, "__commonJS")
+}
+
+// The version keys an hour-cached URL, so it has to track the bytes exactly and
+// stay empty when there is no script — GetChallengePage hangs the whole script
+// tag off it.
+func TestCustomJSVersion(t *testing.T) {
+	tests := []struct {
+		name string
+		src  string
+		want string
+	}{
+		{name: "no script"},
+		{name: "digest of the bytes", src: "hookA();", want: "b3b45f2d"},
+		{name: "a changed script changes the version", src: "hookB();", want: "fd27dc63"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			require.Equal(t, tc.want, CustomJSVersion(tc.src))
+		})
+	}
+}
diff --git a/pkg/appsec/challenge/customjs_test.go b/pkg/appsec/challenge/customjs_test.go
new file mode 100644
index 00000000000..5de12bb296c
--- /dev/null
+++ b/pkg/appsec/challenge/customjs_test.go
@@ -0,0 +1,191 @@
+package challenge
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	logtest "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// customSentinel must match the constant in challenge.js (CSEC_CUSTOM_NAME) and
+// in obfuscate.js (reservedStrings). Hardcoded so a rename that misses one of
+// them fails here rather than silently in the browser, where the hub script and
+// the challenge bundle would no longer meet.
+const customSentinel = "__CSEC_CUSTOM_DETECT_v1__"
+
+func TestCustomJS_SentinelSurvivesObfuscation(t *testing.T) {
+	rt := &ChallengeRuntime{}
+	require.NoError(t, rt.seedCacheFromInitialBundle())
+
+	assert.Contains(t, rt.getChallengeCode(), customSentinel,
+		"was %s dropped from reservedStrings in obfuscate.js?", customSentinel)
+}
+
+func TestCustomJS_ScriptTag(t *testing.T) {
+	rt := newChallengeRuntimeForSplitTest(t, testKeyRing())
+
+	// Unreferenced with no script loaded, so a challenge page doesn't request a
+	// file that isn't there.
+	html, err := rt.GetChallengePage(t.Context(), "test-agent", 8)
+	require.NoError(t, err)
+	require.NotContains(t, html, ChallengeCustomJSPath)
+
+	rt.setCustomJS("globalThis.__CSEC_CUSTOM_DETECT_v1__ = [];")
+
+	html, err = rt.GetChallengePage(t.Context(), "test-agent", 8)
+	require.NoError(t, err)
+	assert.Contains(t, html, ChallengeCustomJSPath)
+
+	// Served from its own cacheable path, not inlined.
+	assert.NotContains(t, html, rt.customJS)
+
+	// Registration has to precede the module that invokes the hooks.
+	assert.Less(t, strings.Index(html, ChallengeCustomJSPath), strings.Index(html, `<script type="module">`))
+}
+
+// The full chain a hub-shipped script depends on: client-side obfuscation,
+// signature check, JSON decode, proto conversion, sealed cookie.
+func TestCustomDetectSurvivesFullSubmission(t *testing.T) {
+	c := &ChallengeRuntime{keys: testKeyRing(), powDifficulty: 8, cookieTTL: time.Hour, spent: newSpentSet(spentSetDefaultMaxEntries)}
+
+	submitted := FingerprintData{
+		FSID: "FS1_custom",
+		Custom: map[string]CustomValue{
+			"audioCtxNoise": {Kind: CustomKindBool, Bool: true},
+			"clearedByHook": {Kind: CustomKindBool, Bool: false},
+			"audioHash":     {Kind: CustomKindString, Str: "a91f2c3d"},
+			"collectMs":     {Kind: CustomKindNumber, Number: 512},
+			"fonts":         {Kind: CustomKindStrings, Strings: []string{"Arial", "Helvetica"}},
+		},
+	}
+
+	r, ts := freshChallenge(t)
+	body := buildValidBodyWithFingerprint(t, c.powDifficulty, r, ts, submitted)
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "http://example.com/submit", strings.NewReader(body))
+	require.NoError(t, err)
+	req.Header.Set("User-Agent", "test-agent")
+
+	ck, decoded, _, err := c.ValidateChallengeResponse(req, []byte(body))
+	require.NoError(t, err)
+	require.NotNil(t, ck)
+
+	// What on_challenge_submit sees.
+	assert.Equal(t, submitted.Custom, decoded.Custom)
+
+	// And what on_challenge sees on every later request.
+	parsed, err := http.ParseSetCookie(ck.String())
+	require.NoError(t, err)
+
+	cd, err := c.ValidCookie(parsed, "test-agent")
+	require.NoError(t, err)
+	assert.Equal(t, submitted.Custom, cd.Fingerprint.Custom)
+
+	// A hook that cleared a detection reports false, distinct from unset.
+	assert.True(t, cd.Fingerprint.HasCustom("clearedByHook"))
+	assert.False(t, cd.Fingerprint.Custom["clearedByHook"].Bool)
+	assert.False(t, cd.Fingerprint.HasCustom("neverSet"))
+}
+
+// A script that reports more than the cookie can hold must not cost the visitor
+// their submission: the map is dropped, the cookie is still minted, and the
+// rules on this request still see everything that was reported.
+func TestOversizedCustomStillYieldsACookie(t *testing.T) {
+	c := &ChallengeRuntime{keys: testKeyRing(), powDifficulty: 8, cookieTTL: time.Hour, spent: newSpentSet(spentSetDefaultMaxEntries)}
+
+	custom := oversizedCustom()
+	submitted := FingerprintData{FSID: "FS1_fat", Custom: custom}
+
+	r, ts := freshChallenge(t)
+	body := buildValidBodyWithFingerprint(t, c.powDifficulty, r, ts, submitted)
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "http://example.com/submit", strings.NewReader(body))
+	require.NoError(t, err)
+	req.Header.Set("User-Agent", "test-agent")
+
+	ck, decoded, _, err := c.ValidateChallengeResponse(req, []byte(body))
+	require.NoError(t, err)
+	require.NotNil(t, ck)
+
+	assert.Equal(t, custom, decoded.Custom)
+
+	parsed, err := http.ParseSetCookie(ck.String())
+	require.NoError(t, err)
+
+	cd, err := c.ValidCookie(parsed, "test-agent")
+	require.NoError(t, err)
+
+	// Shed on the way into the cookie, so later requests see none of it.
+	assert.Empty(t, cd.Fingerprint.Custom)
+	assert.Equal(t, "FS1_fat", cd.Fingerprint.FSID)
+}
+
+// oversizedCustom reports far more than the ~1kB the fingerprint leaves in the
+// cookie, so sealing always overflows.
+func oversizedCustom() map[string]CustomValue {
+	custom := make(map[string]CustomValue, 40)
+
+	for i := range 40 {
+		custom[fmt.Sprintf("detector%02d", i)] = CustomValue{
+			Kind: CustomKindString,
+			Str:  strings.Repeat("x", 200),
+		}
+	}
+
+	return custom
+}
+
+// Overflow follows from what the detectors report, not from the visitor, so an
+// operator has to see it — but not once per submission.
+func TestCustomOverflowWarnsOnce(t *testing.T) {
+	capture, hook := logtest.NewNullLogger()
+	capture.SetLevel(log.DebugLevel)
+
+	c := &ChallengeRuntime{
+		keys:          testKeyRing(),
+		powDifficulty: 8,
+		cookieTTL:     time.Hour,
+		spent:         newSpentSet(spentSetDefaultMaxEntries),
+		logger:        log.NewEntry(capture),
+	}
+
+	submitted := FingerprintData{FSID: "FS1_fat", Custom: oversizedCustom()}
+
+	for range 3 {
+		// A fresh nonce per iteration: the first one is burnt on use.
+		r, ts := freshChallenge(t)
+		body := buildValidBodyWithFingerprint(t, c.powDifficulty, r, ts, submitted)
+
+		req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "http://example.com/submit", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("User-Agent", "test-agent")
+
+		ck, _, _, err := c.ValidateChallengeResponse(req, []byte(body))
+		require.NoError(t, err)
+		require.NotNil(t, ck)
+	}
+
+	var warns, debugs int
+
+	for _, e := range hook.AllEntries() {
+		if !strings.Contains(e.Message, "do not fit in the cookie") {
+			continue
+		}
+
+		switch e.Level {
+		case log.WarnLevel:
+			warns++
+		case log.DebugLevel:
+			debugs++
+		}
+	}
+
+	require.Equal(t, 1, warns)
+	require.Equal(t, 2, debugs)
+}
diff --git a/pkg/appsec/challenge/customjs_timeout_test.go b/pkg/appsec/challenge/customjs_timeout_test.go
new file mode 100644
index 00000000000..712d46d5261
--- /dev/null
+++ b/pkg/appsec/challenge/customjs_timeout_test.go
@@ -0,0 +1,165 @@
+package challenge
+
+import (
+	"regexp"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	logtest "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomJSTimeoutDefaults(t *testing.T) {
+	tests := []struct {
+		name string
+		opts []Option
+		want time.Duration
+	}{
+		{name: "unset", want: DefaultCustomJSTimeout},
+		{name: "configured", opts: []Option{WithCustomJSTimeout(1500 * time.Millisecond)}, want: 1500 * time.Millisecond},
+		// Zero and negative fall back rather than disabling the budget: a page
+		// with no deadline would let one bad hook hang every visitor.
+		{name: "zero", opts: []Option{WithCustomJSTimeout(0)}, want: DefaultCustomJSTimeout},
+		{name: "negative", opts: []Option{WithCustomJSTimeout(-time.Second)}, want: DefaultCustomJSTimeout},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rt, err := NewChallengeRuntime(t.Context(), append(tc.opts, withoutPreWarm())...)
+			require.NoError(t, err)
+
+			assert.Equal(t, tc.want, rt.customJSTimeout)
+		})
+	}
+}
+
+// The value only matters if it reaches the browser, and it rides the same
+// inline-var mechanism as the PoW parameters.
+func TestCustomJSTimeoutReachesThePage(t *testing.T) {
+	tests := []struct {
+		name string
+		opts []Option
+		want string
+	}{
+		{name: "default", want: "_cjsT=500"},
+		{name: "configured", opts: []Option{WithCustomJSTimeout(1500 * time.Millisecond)}, want: "_cjsT=1500"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rt, err := NewChallengeRuntime(t.Context(), append(tc.opts, WithMasterSecret(testSecret), withoutPreWarm())...)
+			require.NoError(t, err)
+
+			html, err := rt.GetChallengePage(t.Context(), "test-agent", 8)
+			require.NoError(t, err)
+
+			assert.Contains(t, html, tc.want)
+		})
+	}
+}
+
+func TestCustomJSTimeoutConfig(t *testing.T) {
+	d := 2 * time.Second
+
+	t.Run("MergeFrom takes a non-nil value", func(t *testing.T) {
+		c := &Config{}
+		c.MergeFrom(&Config{CustomJSTimeout: &d})
+		require.NotNil(t, c.CustomJSTimeout)
+		assert.Equal(t, d, *c.CustomJSTimeout)
+	})
+
+	t.Run("MergeFrom leaves an unset value alone", func(t *testing.T) {
+		c := &Config{CustomJSTimeout: &d}
+		c.MergeFrom(&Config{})
+		require.NotNil(t, c.CustomJSTimeout)
+		assert.Equal(t, d, *c.CustomJSTimeout)
+	})
+
+	t.Run("BuildOptions carries it to the runtime", func(t *testing.T) {
+		opts, err := BuildOptions(&Config{CustomJSTimeout: &d}, nil)
+		require.NoError(t, err)
+
+		var resolved runtimeOptions
+		for _, o := range opts {
+			o(&resolved)
+		}
+
+		assert.Equal(t, d, resolved.customJSTimeout)
+	})
+}
+
+// Guards the JS-side contract: the injected name and the name the bundle reads
+// are built separately and only meet on this string.
+func TestCustomJSTimeoutVarNameMatchesBundle(t *testing.T) {
+	rt := &ChallengeRuntime{}
+	require.NoError(t, rt.seedCacheFromInitialBundle())
+
+	assert.Contains(t, rt.getChallengeCode(), "_cjsT",
+		"the obfuscated bundle must still read the injected _cjsT var")
+	assert.Contains(t, htmlTemplate, "_cjsT=",
+		"the challenge page must still inject _cjsT")
+}
+
+// The script is served uncached, so the page must point at the bare path: a
+// query the dispatcher does not route on would only be dead weight.
+func TestCustomJSURLIsUnversioned(t *testing.T) {
+	rt, err := NewChallengeRuntime(t.Context(),
+		WithMasterSecret(testSecret), WithCustomJS("hookA();"), withoutPreWarm())
+	require.NoError(t, err)
+
+	html, err := rt.GetChallengePage(t.Context(), "test-agent", 8)
+	require.NoError(t, err)
+
+	require.Contains(t, html, ChallengeCustomJSPath)
+	assert.NotRegexp(t, regexp.QuoteMeta(ChallengeCustomJSPath)+`\?`, html)
+}
+
+// The startup summary is where an operator confirms which build of the shipped
+// detections an engine is running.
+func TestChallengeRuntimeSummaryCarriesCustomJS(t *testing.T) {
+	tests := []struct {
+		name   string
+		script string
+	}{
+		{name: "with a script", script: "hookA();"},
+		{name: "without a script"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			capture, hook := logtest.NewNullLogger()
+
+			opts := []Option{WithMasterSecret(testSecret), withoutPreWarm(), WithLogger(log.NewEntry(capture))}
+			if tc.script != "" {
+				opts = append(opts, WithCustomJS(tc.script))
+			}
+
+			_, err := NewChallengeRuntime(t.Context(), opts...)
+			require.NoError(t, err)
+
+			var summary *log.Entry
+
+			for _, e := range hook.AllEntries() {
+				if e.Message == "WAF challenge runtime initialized" {
+					summary = e
+				}
+			}
+
+			require.NotNil(t, summary)
+
+			// No script means no empty fields: an empty version on every
+			// challenge-mode startup would read as a failed load.
+			if tc.script == "" {
+				require.NotContains(t, summary.Data, "custom_js_version")
+				require.NotContains(t, summary.Data, "custom_js_timeout")
+
+				return
+			}
+
+			require.Equal(t, CustomJSVersion(tc.script), summary.Data["custom_js_version"])
+			require.Equal(t, DefaultCustomJSTimeout, summary.Data["custom_js_timeout"])
+		})
+	}
+}
diff --git a/pkg/appsec/challenge/fingerprint.go b/pkg/appsec/challenge/fingerprint.go
index 535f6be2d10..f8ab0dd062b 100644
--- a/pkg/appsec/challenge/fingerprint.go
+++ b/pkg/appsec/challenge/fingerprint.go
@@ -329,6 +329,11 @@ type FingerprintData struct {
 	FastBotDetectionDetails fingerprintFastBotDetectionDetails `json:"fastBotDetectionDetails"`
 	Bot                     fingerprintBotAlias                `json:"-"`
 
+	// Custom holds what the hub-distributed detection script reported, read by
+	// rules as fingerprint.Custom["name"].Bool (see fingerprint_custom.go).
+	// Unset keys yield the zero CustomValue, so filters need no presence check.
+	Custom map[string]CustomValue `json:"custom"`
+
 	// Allowlisted is true on cookies minted by GrantChallengeCookie (operator
 	// bypass for trusted bots like Googlebot) — these cookies never went
 	// through a real challenge submission and carry no measured signals.
diff --git a/pkg/appsec/challenge/fingerprint_custom.go b/pkg/appsec/challenge/fingerprint_custom.go
new file mode 100644
index 00000000000..14bf7d205e1
--- /dev/null
+++ b/pkg/appsec/challenge/fingerprint_custom.go
@@ -0,0 +1,123 @@
+// fingerprint_custom.go holds the `custom` map that hub-distributed detection
+// scripts fill in after fpscanner has run, so new detections and false-positive
+// fixes can ship without a release.
+
+package challenge
+
+import (
+	"encoding/json"
+)
+
+// CustomKind tags which field of a CustomValue carries the value.
+type CustomKind string
+
+const (
+	CustomKindNone    CustomKind = ""
+	CustomKindBool    CustomKind = "bool"
+	CustomKindString  CustomKind = "string"
+	CustomKindNumber  CustomKind = "number"
+	CustomKindStrings CustomKind = "strings"
+	CustomKindFloats  CustomKind = "floats"
+)
+
+// CustomValue is one entry a detection script can produce.
+// Kind naming the field that holds the value.
+//
+// The zero value reads as "absent".
+//
+//nolint:recvcheck
+type CustomValue struct {
+	Kind    CustomKind
+	Bool    bool
+	Str     string
+	Number  float64
+	Strings []string
+	Floats  []float64
+}
+
+// IsSet distinguishes "absent" from "present and false"
+func (v CustomValue) IsSet() bool {
+	return v.Kind != CustomKindNone
+}
+
+// MarshalJSON restores the browser's shape,
+// allows DumpFingerprint to show operators what was reported.
+func (v CustomValue) MarshalJSON() ([]byte, error) {
+	switch v.Kind {
+	case CustomKindBool:
+		return json.Marshal(v.Bool)
+	case CustomKindString:
+		return json.Marshal(v.Str)
+	case CustomKindNumber:
+		return json.Marshal(v.Number)
+	case CustomKindStrings:
+		return json.Marshal(v.Strings)
+	case CustomKindFloats:
+		return json.Marshal(v.Floats)
+	case CustomKindNone:
+		return []byte("null"), nil
+	}
+
+	return []byte("null"), nil
+}
+
+// UnmarshalJSON turns unrecognized shapes into the
+// zero value rather than an error. avoid breaking too easily on bad submission.
+func (v *CustomValue) UnmarshalJSON(data []byte) error {
+	*v = CustomValue{}
+
+	var raw any
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+
+	switch val := raw.(type) {
+	case bool:
+		v.Kind, v.Bool = CustomKindBool, val
+	case string:
+		v.Kind, v.Str = CustomKindString, val
+	case float64:
+		v.Kind, v.Number = CustomKindNumber, val
+	case []any:
+		v.decodeArray(val)
+	}
+
+	return nil
+}
+
+// decodeArray is a helper to decode our float/string arrays. A mixed array has
+// no proto oneof to land in, so it decodes as absent.
+func (v *CustomValue) decodeArray(items []any) {
+	if len(items) == 0 {
+		return
+	}
+
+	switch items[0].(type) {
+	case string:
+		out := make([]string, 0, len(items))
+
+		for _, it := range items {
+			s, ok := it.(string)
+			if !ok {
+				return
+			}
+
+			out = append(out, s)
+		}
+
+		v.Kind, v.Strings = CustomKindStrings, out
+	case float64:
+		out := make([]float64, 0, len(items))
+
+		for _, it := range items {
+			f, ok := it.(float64)
+			if !ok {
+				return
+			}
+
+			out = append(out, f)
+		}
+
+		v.Kind, v.Floats = CustomKindFloats, out
+	}
+}
diff --git a/pkg/appsec/challenge/fingerprint_custom_proto_test.go b/pkg/appsec/challenge/fingerprint_custom_proto_test.go
new file mode 100644
index 00000000000..78785e3bd93
--- /dev/null
+++ b/pkg/appsec/challenge/fingerprint_custom_proto_test.go
@@ -0,0 +1,75 @@
+package challenge
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge/pb"
+)
+
+func TestCustomProtoRoundTrip(t *testing.T) {
+	in := map[string]CustomValue{
+		"aBool":       {Kind: CustomKindBool, Bool: true},
+		"aFalseBool":  {Kind: CustomKindBool, Bool: false},
+		"aString":     {Kind: CustomKindString, Str: "a91f"},
+		"aNumber":     {Kind: CustomKindNumber, Number: 512.5},
+		"someStrings": {Kind: CustomKindStrings, Strings: []string{"Arial", "Helvetica"}},
+		"someFloats":  {Kind: CustomKindFloats, Floats: []float64{12.5, 30}},
+	}
+
+	fp := FingerprintData{Custom: in}
+
+	got := fingerprintDataFromProto(fp.ToProto())
+
+	assert.Equal(t, in, got.Custom)
+
+	// "present and false" must survive distinctly from "absent".
+	assert.True(t, got.HasCustom("aFalseBool"))
+	assert.False(t, got.Custom["aFalseBool"].Bool)
+	assert.False(t, got.HasCustom("neverSet"))
+}
+
+func TestCustomProtoEmptyStaysNil(t *testing.T) {
+	assert.Nil(t, (&FingerprintData{}).ToProto().GetCustom())
+	assert.Nil(t, customToProto(map[string]CustomValue{"x": {}}))
+	assert.Nil(t, customFromProto(nil))
+	// What a truncated or older writer leaves behind.
+	assert.Nil(t, customFromProto(map[string]*pb.CustomValue{"x": {}}))
+}
+
+// cookieHeadroomFloor is the slack a realistic envelope must keep for the
+// custom map and for growth, so that eating the margin with a new fpscanner
+// signal is a reviewed decision rather than something users discover as
+// challenges failing on browsers with long user agents.
+const cookieHeadroomFloor = 1024
+
+func TestRealisticFingerprintLeavesCookieHeadroom(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("testdata", "realistic_fingerprint.json"))
+	require.NoError(t, err)
+
+	var fp FingerprintData
+	require.NoError(t, json.Unmarshal(raw, &fp))
+
+	// A stub fixture would make the headroom assertion meaningless.
+	require.NotEmpty(t, fp.FSID)
+	require.NotEmpty(t, fp.Signals.Browser.UserAgent)
+	require.NotEmpty(t, fp.Signals.Device.Keyboard.Layout)
+
+	envelope := &pb.ChallengeCookie{Fingerprint: fp.ToProto(), PowDifficulty: PowDifficultyMedium}
+
+	// Mirrors sealCookieV0: base64 expansion, version byte, GCM nonce and tag.
+	ceiling := MaxCookieLen/4*3 - 1 - 12 - 16 - cookiePlaintextFixedHeaderLen
+	size := proto.Size(envelope)
+
+	t.Logf("realistic envelope: %d bytes, ceiling %d, headroom %d", size, ceiling, ceiling-size)
+
+	assert.LessOrEqual(t, size+cookieHeadroomFloor, ceiling,
+		"a realistic fingerprint no longer leaves %d bytes of slack; trim a signal",
+		cookieHeadroomFloor)
+}
diff --git a/pkg/appsec/challenge/fingerprint_custom_test.go b/pkg/appsec/challenge/fingerprint_custom_test.go
new file mode 100644
index 00000000000..e1989f311c5
--- /dev/null
+++ b/pkg/appsec/challenge/fingerprint_custom_test.go
@@ -0,0 +1,186 @@
+package challenge
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/expr-lang/expr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomValueDecode(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		want CustomValue
+	}{
+		{
+			name: "bool",
+			raw:  `true`,
+			want: CustomValue{Kind: CustomKindBool, Bool: true},
+		},
+		{
+			name: "false is set, not absent",
+			raw:  `false`,
+			want: CustomValue{Kind: CustomKindBool, Bool: false},
+		},
+		{
+			name: "string",
+			raw:  `"a91f"`,
+			want: CustomValue{Kind: CustomKindString, Str: "a91f"},
+		},
+		{
+			name: "number",
+			raw:  `512.5`,
+			want: CustomValue{Kind: CustomKindNumber, Number: 512.5},
+		},
+		{
+			name: "string array",
+			raw:  `["Arial","Helvetica"]`,
+			want: CustomValue{Kind: CustomKindStrings, Strings: []string{"Arial", "Helvetica"}},
+		},
+		{
+			name: "float array",
+			raw:  `[12.5,30]`,
+			want: CustomValue{Kind: CustomKindFloats, Floats: []float64{12.5, 30}},
+		},
+		// Shapes a detection script should not produce. They must decode to
+		// "absent" rather than fail the submission.
+		{name: "object", raw: `{"a":1}`, want: CustomValue{}},
+		{name: "null", raw: `null`, want: CustomValue{}},
+		{name: "empty array", raw: `[]`, want: CustomValue{}},
+		{name: "mixed array", raw: `["a",1]`, want: CustomValue{}},
+		{name: "array of objects", raw: `[{"a":1}]`, want: CustomValue{}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var got CustomValue
+			require.NoError(t, json.Unmarshal([]byte(tc.raw), &got))
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestCustomValueMarshal(t *testing.T) {
+	tests := []struct {
+		name string
+		in   CustomValue
+		want string
+	}{
+		{name: "bool", in: CustomValue{Kind: CustomKindBool, Bool: true}, want: `true`},
+		{name: "false bool", in: CustomValue{Kind: CustomKindBool}, want: `false`},
+		{name: "string", in: CustomValue{Kind: CustomKindString, Str: "a91f"}, want: `"a91f"`},
+		{name: "number", in: CustomValue{Kind: CustomKindNumber, Number: 512.5}, want: `512.5`},
+		{
+			name: "strings",
+			in:   CustomValue{Kind: CustomKindStrings, Strings: []string{"Arial", "Helvetica"}},
+			want: `["Arial","Helvetica"]`,
+		},
+		{
+			name: "floats",
+			in:   CustomValue{Kind: CustomKindFloats, Floats: []float64{12.5, 30}},
+			want: `[12.5,30]`,
+		},
+		{name: "unset", in: CustomValue{}, want: `null`},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := json.Marshal(tc.in)
+			require.NoError(t, err)
+			assert.JSONEq(t, tc.want, string(out))
+
+			if tc.in.Kind == CustomKindNone {
+				return
+			}
+
+			var back CustomValue
+			require.NoError(t, json.Unmarshal(out, &back))
+			assert.Equal(t, tc.in, back)
+		})
+	}
+}
+
+func TestFingerprintCustomDecode(t *testing.T) {
+	raw := `{
+		"fsid": "FS1_x",
+		"custom": {
+			"audioCtxNoise": true,
+			"audioHash": "a91f",
+			"collectMs": 512,
+			"fonts": ["Arial","Helvetica"],
+			"broken": {"nope": 1}
+		}
+	}`
+
+	var fp FingerprintData
+	require.NoError(t, json.Unmarshal([]byte(raw), &fp))
+
+	assert.True(t, fp.Custom["audioCtxNoise"].Bool)
+	assert.Equal(t, "a91f", fp.Custom["audioHash"].Str)
+	assert.InDelta(t, 512.0, fp.Custom["collectMs"].Number, 0.001)
+	assert.Equal(t, []string{"Arial", "Helvetica"}, fp.Custom["fonts"].Strings)
+
+	// An unrepresentable entry is kept as the zero value rather than dropped: it
+	// reads as absent to a rule, and costs the submission nothing.
+	assert.False(t, fp.HasCustom("broken"))
+	assert.Equal(t, []string{"audioCtxNoise", "audioHash", "broken", "collectMs", "fonts"}, fp.CustomKeys())
+
+	// Round-trips in the browser's shape, which is what DumpFingerprint shows.
+	out, err := json.Marshal(fp)
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `"audioCtxNoise":true`)
+}
+
+// Storing CustomValue by value is what lets rules read an unknown key without a
+// presence check; a pointer element would hand them a nil to dereference.
+func TestCustomIsSafeToReadFromExpr(t *testing.T) {
+	fp := &FingerprintData{
+		Custom: map[string]CustomValue{
+			"audioCtxNoise": {Kind: CustomKindBool, Bool: true},
+			"audioHash":     {Kind: CustomKindString, Str: "a91f"},
+			"collectMs":     {Kind: CustomKindNumber, Number: 512},
+			"fonts":         {Kind: CustomKindStrings, Strings: []string{"Arial"}},
+		},
+	}
+
+	tests := []struct {
+		expr string
+		want any
+	}{
+		{expr: `fingerprint.Custom["audioCtxNoise"].Bool`, want: true},
+		{expr: `fingerprint.Custom["audioHash"].Str == "a91f"`, want: true},
+		{expr: `fingerprint.Custom["collectMs"].Number > 500`, want: true},
+		{expr: `"Arial" in fingerprint.Custom["fonts"].Strings`, want: true},
+		{expr: `fingerprint.HasCustom("audioHash")`, want: true},
+		{expr: `fingerprint.Custom["neverSet"].Bool`, want: false},
+		{expr: `fingerprint.Custom["neverSet"].Str == ""`, want: true},
+		{expr: `len(fingerprint.Custom["neverSet"].Strings) == 0`, want: true},
+		{expr: `fingerprint.HasCustom("neverSet")`, want: false},
+	}
+
+	env := map[string]any{"fingerprint": fp}
+
+	for _, tc := range tests {
+		t.Run(tc.expr, func(t *testing.T) {
+			prog, err := expr.Compile(tc.expr, expr.Env(env))
+			require.NoError(t, err)
+
+			out, err := expr.Run(prog, env)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, out)
+		})
+	}
+
+	// Same guarantee on a fingerprint that carries no custom map at all.
+	empty := map[string]any{"fingerprint": &FingerprintData{}}
+
+	prog, err := expr.Compile(`fingerprint.Custom["anything"].Bool`, expr.Env(empty))
+	require.NoError(t, err)
+
+	out, err := expr.Run(prog, empty)
+	require.NoError(t, err)
+	assert.Equal(t, false, out)
+}
diff --git a/pkg/appsec/challenge/fingerprint_helpers.go b/pkg/appsec/challenge/fingerprint_helpers.go
index bac708bb754..b574a657ecb 100644
--- a/pkg/appsec/challenge/fingerprint_helpers.go
+++ b/pkg/appsec/challenge/fingerprint_helpers.go
@@ -1,6 +1,8 @@
 package challenge
 
 import (
+	"sort"
+
 	log "github.com/sirupsen/logrus"
 )
 
@@ -415,3 +417,31 @@ func addVerboseFingerprintFields(fields log.Fields, f *FingerprintData) {
 		fields["fp_time"] = f.Time
 	}
 }
+
+// HasCustom tells "absent" from "present and false", which matters for a
+// detection expected to always report. Rules that only need falsiness can index
+// Custom directly.
+func (f *FingerprintData) HasCustom(key string) bool {
+	if f == nil {
+		return false
+	}
+
+	return f.Custom[key].IsSet()
+}
+
+// CustomKeys lists the reported keys, sorted, for logging and for rules that
+// iterate rather than look up by name.
+func (f *FingerprintData) CustomKeys() []string {
+	if f == nil || len(f.Custom) == 0 {
+		return nil
+	}
+
+	keys := make([]string, 0, len(f.Custom))
+	for k := range f.Custom {
+		keys = append(keys, k)
+	}
+
+	sort.Strings(keys)
+
+	return keys
+}
diff --git a/pkg/appsec/challenge/fingerprint_proto.go b/pkg/appsec/challenge/fingerprint_proto.go
index bb4ab7e40f6..a0c812b390d 100644
--- a/pkg/appsec/challenge/fingerprint_proto.go
+++ b/pkg/appsec/challenge/fingerprint_proto.go
@@ -18,6 +18,7 @@ func fingerprintDataFromProto(p *pb.FingerprintData) FingerprintData {
 		Time:             p.GetTime(),
 		URL:              p.GetUrl(),
 		FastBotDetection: FlexBool(p.GetFastBotDetection()),
+		Custom:           customFromProto(p.GetCustom()),
 	}
 
 	if s := p.GetSignals(); s != nil {
@@ -340,9 +341,84 @@ func (f *FingerprintData) ToProto() *pb.FingerprintData {
 		FastBotDetection:        bool(f.FastBotDetection),
 		FastBotDetectionDetails: f.FastBotDetectionDetails.toProto(),
 		Bot:                     f.Bot.toProto(),
+		Custom:                  customToProto(f.Custom),
 	}
 }
 
+// customToProto skips unset entries: a caseless oneof decodes back to the zero
+// CustomValue anyway, so storing them costs bytes for nothing.
+func customToProto(in map[string]CustomValue) map[string]*pb.CustomValue {
+	if len(in) == 0 {
+		return nil
+	}
+
+	out := make(map[string]*pb.CustomValue, len(in))
+
+	for k, v := range in {
+		var pv *pb.CustomValue
+
+		switch v.Kind {
+		case CustomKindBool:
+			pv = &pb.CustomValue{Value: &pb.CustomValue_B{B: v.Bool}}
+		case CustomKindString:
+			pv = &pb.CustomValue{Value: &pb.CustomValue_S{S: v.Str}}
+		case CustomKindNumber:
+			pv = &pb.CustomValue{Value: &pb.CustomValue_N{N: v.Number}}
+		case CustomKindStrings:
+			pv = &pb.CustomValue{Value: &pb.CustomValue_Ss{Ss: &pb.CustomStringList{Values: v.Strings}}}
+		case CustomKindFloats:
+			pv = &pb.CustomValue{Value: &pb.CustomValue_Ff{Ff: &pb.CustomFloatList{Values: v.Floats}}}
+		case CustomKindNone:
+			continue
+		}
+
+		out[k] = pv
+	}
+
+	if len(out) == 0 {
+		return nil
+	}
+
+	return out
+}
+
+// customFromProto maps a nil or caseless entry to the zero CustomValue, which
+// reads as "absent" to a rule.
+func customFromProto(in map[string]*pb.CustomValue) map[string]CustomValue {
+	if len(in) == 0 {
+		return nil
+	}
+
+	out := make(map[string]CustomValue, len(in))
+
+	for k, pv := range in {
+		var v CustomValue
+
+		switch pv.GetValue().(type) {
+		case *pb.CustomValue_B:
+			v = CustomValue{Kind: CustomKindBool, Bool: pv.GetB()}
+		case *pb.CustomValue_S:
+			v = CustomValue{Kind: CustomKindString, Str: pv.GetS()}
+		case *pb.CustomValue_N:
+			v = CustomValue{Kind: CustomKindNumber, Number: pv.GetN()}
+		case *pb.CustomValue_Ss:
+			v = CustomValue{Kind: CustomKindStrings, Strings: pv.GetSs().GetValues()}
+		case *pb.CustomValue_Ff:
+			v = CustomValue{Kind: CustomKindFloats, Floats: pv.GetFf().GetValues()}
+		default:
+			continue
+		}
+
+		out[k] = v
+	}
+
+	if len(out) == 0 {
+		return nil
+	}
+
+	return out
+}
+
 func (a fingerprintAutomation) toProto() *pb.FingerprintAutomation {
 	return &pb.FingerprintAutomation{
 		Webdriver:                    bool(a.Webdriver),
diff --git a/pkg/appsec/challenge/initial_bundle.js.gz b/pkg/appsec/challenge/initial_bundle.js.gz
index 4014db997cc..d86fb0026cd 100644
Binary files a/pkg/appsec/challenge/initial_bundle.js.gz and b/pkg/appsec/challenge/initial_bundle.js.gz differ
diff --git a/pkg/appsec/challenge/js/README.md b/pkg/appsec/challenge/js/README.md
deleted file mode 100644
index d932326208b..00000000000
--- a/pkg/appsec/challenge/js/README.md
+++ /dev/null
@@ -1,120 +0,0 @@
-# WAF challenge JS pipeline
-
-This directory holds the JavaScript sources that the WAF challenge runtime
-serves to clients, and the build-time tools that turn them into the
-artifacts embedded in the crowdsec binary.
-
-End users running `make build` do **not** need any of the tools below —
-the generated artifacts are committed to the repository and pulled in via
-`//go:embed`. The pipeline is only exercised when someone intentionally
-changes the JS sources.
-
-## What gets generated
-
-Three pipeline steps, all driven by `go:generate` directives in
-`generate.go`:
-
-| Step | Tool used | Output | Used at runtime by |
-|---|---|---|---|
-| `cmd/bundle` | esbuild (Go module) | `fpscanner/fpscanner.js` **and** `challenge_code.js` | `fpscanner.js` is served as-is; `challenge_code.js` is the obfuscator input |
-| `cmd/obfuscate` | esbuild + `javy` | `obfuscate/index.wasm.gz` | `wazero` to obfuscate the dynamic key module per epoch |
-| `cmd/initialbundle` | `wazero` running the obfuscator wasm | `../initial_bundle.js.gz` | Seeded into the challenge cache at startup so the service is ready instantly |
-
-The client JS is split into **two** bundles:
-
-- **`fpscanner/fpscanner.js`** — the public fingerprint scanner
-  (`fpscanner/src/*`, entered via `fpscanner/global.js`), built as a minified
-  IIFE that assigns `globalThis.CrowdsecFingerprintScanner`. It is **served
-  unobfuscated** at `ChallengeFPScannerPath` via a plain `<script src>` tag
-  (cacheable across challenge pages). fpscanner is public open-source code, so
-  there is nothing to hide and no reason to spend CPU obfuscating it.
-- **`challenge_code.js`** — the crypto/glue (`../challenge.js`: SHA-256, HMAC,
-  PoW, fingerprint obfuscation, submission, and the hook registration). This is
-  the **obfuscation input**: `cmd/initialbundle` substitutes the internal-path
-  placeholders and obfuscates it into `../initial_bundle.js.gz`, which the
-  runtime injects inline on the challenge page. The challenge code reads the
-  scanner from `globalThis.CrowdsecFingerprintScanner` at use time.
-
-There is no runtime re-obfuscation of the challenge code — the build-time
-`initial_bundle.js.gz` is the single static variant served. Only the sensitive
-per-epoch key module is re-obfuscated at runtime (see `../dynamic_module.go`).
-
-`obfuscate/obfuscate.js` is a small driver around the vendored
-`obfuscate/javascript-obfuscator.js` (≈1.6 MB, kept in tree so we don't
-pull from npm at build time). The driver reads source code from stdin,
-runs `JavaScriptObfuscator.obfuscate(...)` with the `high-obfuscation`
-preset (plus a `reservedStrings` entry for the `__CSEC_CHALLENGE_HOOK_v1__`
-sentinel that bridges the static and dynamic bundles), and writes the
-obfuscated code to stdout. `javy` then compiles that driver to a WASM
-module.
-
-## How to regenerate
-
-```sh
-make generate-challenge-js
-```
-
-Or directly:
-
-```sh
-go generate ./pkg/appsec/challenge/js/...
-```
-
-Both invocations require `javy` (the Bytecode Alliance JS-to-WASM
-compiler) to be on `PATH`. There is no apt/brew package; install via
-the upstream releases:
-
-```sh
-curl -sL -o javy.gz \
-  https://github.com/bytecodealliance/javy/releases/download/v9.1.0/javy-x86_64-linux-v9.1.0.gz
-gunzip javy.gz && chmod +x javy && mv javy /usr/local/bin/
-```
-
-(Substitute the platform suffix for macOS/Windows.) `javy` is
-**build-time only** — it is not a runtime dependency of crowdsec.
-
-Regeneration is fast now: only the small `challenge_code.js` (~4 KB) goes
-through the obfuscator's `high-obfuscation` preset; the bulk of the client
-JS (fpscanner, ~33 KB) is served raw and is never obfuscated.
-
-> `javy` is only needed by `cmd/obfuscate` (it rebuilds `index.wasm.gz`). If
-> you only changed `challenge.js` or the fpscanner sources, you can skip javy
-> and regenerate just the two bundles:
->
-> ```sh
-> cd pkg/appsec/challenge/js && go run ./cmd/bundle && go run ./cmd/initialbundle
-> ```
-
-## When to regenerate
-
-Run `make generate-challenge-js` (or the two-step command above) after
-changing any of:
-
-- `pkg/appsec/challenge/challenge.js`
-- `pkg/appsec/challenge/dynamic_module.js.tmpl`
-- `pkg/appsec/challenge/js/fpscanner/global.js`
-- `pkg/appsec/challenge/js/fpscanner/src/**/*.ts`
-- `pkg/appsec/challenge/js/obfuscate/obfuscate.js`
-- The vendored `pkg/appsec/challenge/js/obfuscate/javascript-obfuscator.js`
-  (only when intentionally upgrading)
-
-The pipeline output bytes (`fpscanner/fpscanner.js`, `challenge_code.js`,
-`index.wasm.gz`, `initial_bundle.js.gz`) are committed so a clean `git clone`
-builds and runs without javy.
-
-## Sentinel survival
-
-The `__CSEC_CHALLENGE_HOOK_v1__` literal must appear verbatim in both
-the obfuscated challenge code (`initial_bundle.js.gz`) and any dynamic key
-module generated at runtime, so the two bundles meet at the same `globalThis`
-key after independent obfuscation passes. The
-`reservedStrings: ["__CSEC_CHALLENGE_HOOK_v1__"]` option in
-`obfuscate/obfuscate.js` is what guarantees this. If you change the
-sentinel string, change it in **all three** places:
-
-- `obfuscate/obfuscate.js` — `reservedStrings`
-- `pkg/appsec/challenge/challenge.js` — `CSEC_HOOK_NAME`
-- `pkg/appsec/challenge/dynamic_module.js.tmpl` — `hookName`
-
-The Go-side regression test
-`TestSplitBundle_HookSentinelInBakedBundle` will fire on a mismatch.
diff --git a/pkg/appsec/challenge/js/challenge_code.js b/pkg/appsec/challenge/js/challenge_code.js
index 3540566e9b6..d9f88fd69db 100644
--- a/pkg/appsec/challenge/js/challenge_code.js
+++ b/pkg/appsec/challenge/js/challenge_code.js
@@ -1 +1 @@
-var J=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function C(e){let t=1779033703,n=3144134277,c=1013904242,f=2773480762,i=1359893119,a=2600822924,s=528734635,o=1541459225,w=e.length,y=w*8,u=64-(w+9)%64,x=w+1+(u===64?0:u)+8,b=new Uint8Array(x);b.set(e),b[w]=128;let L=new DataView(b.buffer);L.setUint32(x-4,y,!1);let l=new Int32Array(64);for(let k=0;k<x;k+=64){for(let r=0;r<16;r++)l[r]=L.getInt32(k+r*4,!1);for(let r=16;r<64;r++){let H=(l[r-15]>>>7|l[r-15]<<25)^(l[r-15]>>>18|l[r-15]<<14)^l[r-15]>>>3|0,O=(l[r-2]>>>17|l[r-2]<<15)^(l[r-2]>>>19|l[r-2]<<13)^l[r-2]>>>10|0;l[r]=l[r-16]+H+l[r-7]+O|0}let h=t,_=n,m=c,v=f,d=i,U=a,P=s,E=o;for(let r=0;r<64;r++){let H=(d>>>6|d<<26)^(d>>>11|d<<21)^(d>>>25|d<<7)|0,O=d&U^~d&P|0,R=E+H+O+J[r]+l[r]|0,N=(h>>>2|h<<30)^(h>>>13|h<<19)^(h>>>22|h<<10)|0,V=h&_^h&m^_&m|0,G=N+V|0;E=P,P=U,U=d,d=v+R|0,v=m,m=_,_=h,h=R+G|0}t=t+h|0,n=n+_|0,c=c+m|0,f=f+v|0,i=i+d|0,a=a+U|0,s=s+P|0,o=o+E|0}let M=new Uint8Array(32),p=new DataView(M.buffer);return p.setUint32(0,t,!1),p.setUint32(4,n,!1),p.setUint32(8,c,!1),p.setUint32(12,f,!1),p.setUint32(16,i,!1),p.setUint32(20,a,!1),p.setUint32(24,s,!1),p.setUint32(28,o,!1),M}function K(e){let t="";for(let n=0;n<e.length;n++)t+=(e[n]>>4).toString(16)+(e[n]&15).toString(16);return t}function g(e){return new TextEncoder().encode(e)}function I(e,t){e.length>64&&(e=C(e));let n=new Uint8Array(64);n.set(e);let c=new Uint8Array(64),f=new Uint8Array(64);for(let o=0;o<64;o++)c[o]=n[o]^54,f[o]=n[o]^92;let i=new Uint8Array(64+t.length);i.set(c),i.set(t,64);let a=C(i),s=new Uint8Array(96);return s.set(f),s.set(a,64),C(s)}function W(e,t){return K(I(g(e),g(t)))}function q(e){let t=new Uint8Array(e.length/2);for(let n=0;n<t.length;n++)t[n]=parseInt(e.substr(n*2,2),16);return t}function z(e,t){return K(I(q(e),g(t)))}var F="__CROWDSEC_POW_WORKER_PATH__",Q=4,X=44;function Y(){let e=typeof navigator<"u"&&navigator.hardwareConcurrency||1;return Math.max(1,Math.min(e,Q))}function Z(e){if(typeof e!="string"||e.length===0||e.length>X)return!1;for(let t=0;t<e.length;t++)if(e.charCodeAt(t)>127)return!1;return!0}function $(){try{return typeof fetch!="function"||typeof Blob!="function"||typeof URL>"u"||typeof URL.createObjectURL!="function"?Promise.resolve(null):fetch(F,{credentials:"same-origin"}).then(e=>e.ok?e.text():Promise.reject(new Error("pow worker http "+e.status))).then(e=>URL.createObjectURL(new Blob([e],{type:"text/javascript"}))).catch(()=>null)}catch{return Promise.resolve(null)}}function ee(e,t){return t<=0||t>64?Promise.resolve("0"):Z(e)?$().then(n=>T(n,e,t).catch(c=>n?T(null,e,t):Promise.reject(c))).catch(()=>te(e,t)):Promise.reject(new Error("pow: unusable salt"))}function T(e,t,n){let c=Y(),f=e||F;return new Promise((i,a)=>{let s=new Array(c).fill(null),o=!1,w=c,y=()=>{for(let u of s)if(u)try{u.terminate()}catch{}if(e)try{URL.revokeObjectURL(e)}catch{}};for(let u=0;u<c;u++){let x;try{x=new Worker(f)}catch{--w<=0&&!o&&(o=!0,y(),a(new Error("no pow worker")));continue}s[u]=x,x.onmessage=b=>{o||(o=!0,y(),i(b.data))},x.onerror=x.onmessageerror=()=>{if(!o){try{x.terminate()}catch{}s[u]=null,--w<=0&&(o=!0,y(),a(new Error("pow pool died")))}},x.postMessage({p:t,d:n,start:u,stride:c})}})}function te(e,t){let n=0;for(;;){let c=e+n.toString(36),f=C(g(c)),i=t>>3,a=t&7,s=!0;for(let o=0;o<i;o++)if(f[o]!==0){s=!1;break}if(s&&a>0){let o=255<<8-a&255;(f[i]&o)!==0&&(s=!1)}if(s)return n.toString(36);n++}}function ne(e,t){let n=g(e),c=g(t),f=new Uint8Array(c.length);for(let a=0;a<c.length;a++)f[a]=c[a]^n[a%n.length];let i=String.fromCharCode(...f);return btoa(i)}var j=typeof _ts<"u"?_ts:"",B=typeof _powP<"u"?_powP:"",oe=typeof _powM<"u"?_powM:"",D=typeof _powD<"u"?_powD:20,A=typeof _r<"u"?_r:"",re="__CROWDSEC_SUBMIT_PATH__";function S(e){if(typeof window.crowdsecSetChallengeStatus=="function"){window.crowdsecSetChallengeStatus(e);return}window.dispatchEvent(new CustomEvent("crowdsec-challenge-status",{detail:{status:e}}))}var ce="__CSEC_CHALLENGE_HOOK_v1__";async function ae(e){let t=globalThis.CrowdsecFingerprintScanner;if(typeof t!="function"){S("fail");return}let n,c;try{[n,c]=await Promise.all([ee(B,D),new t().collectFingerprint({encrypt:!1})])}catch{S("fail");return}let f=z(e,A),i=W(f,"fpenc"+A),a=ne(i,JSON.stringify(c)),s=W(f,A+j+n+a);return fetch(re,{method:"POST",credentials:"same-origin",body:new URLSearchParams({f:a,r:A,ts:j,sig:s,n,p:B,m:oe,d:D,u:window.location.pathname})}).then(o=>o.json()).then(o=>{let w=typeof o?.status=="string"?o.status:"fail";S(w)}).catch(()=>{S("fail")})}globalThis[ce]=function(e){if(!e||typeof e.key!="string"||e.key.length===0){S("fail");return}ae(e.key)};
+var J=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function A(e){let t=1779033703,n=3144134277,o=1013904242,a=2773480762,f=1359893119,s=2600822924,i=528734635,r=1541459225,w=e.length,y=w*8,u=64-(w+9)%64,x=w+1+(u===64?0:u)+8,_=new Uint8Array(x);_.set(e),_[w]=128;let M=new DataView(_.buffer);M.setUint32(x-4,y,!1);let l=new Int32Array(64);for(let E=0;E<x;E+=64){for(let c=0;c<16;c++)l[c]=M.getInt32(E+c*4,!1);for(let c=16;c<64;c++){let v=(l[c-15]>>>7|l[c-15]<<25)^(l[c-15]>>>18|l[c-15]<<14)^l[c-15]>>>3|0,O=(l[c-2]>>>17|l[c-2]<<15)^(l[c-2]>>>19|l[c-2]<<13)^l[c-2]>>>10|0;l[c]=l[c-16]+v+l[c-7]+O|0}let h=t,g=n,S=o,T=a,d=f,C=s,U=i,k=r;for(let c=0;c<64;c++){let v=(d>>>6|d<<26)^(d>>>11|d<<21)^(d>>>25|d<<7)|0,O=d&C^~d&U|0,H=k+v+O+J[c]+l[c]|0,F=(h>>>2|h<<30)^(h>>>13|h<<19)^(h>>>22|h<<10)|0,G=h&g^h&S^g&S|0,V=F+G|0;k=U,U=C,C=d,d=T+H|0,T=S,S=g,g=h,h=H+V|0}t=t+h|0,n=n+g|0,o=o+S|0,a=a+T|0,f=f+d|0,s=s+C|0,i=i+U|0,r=r+k|0}let D=new Uint8Array(32),p=new DataView(D.buffer);return p.setUint32(0,t,!1),p.setUint32(4,n,!1),p.setUint32(8,o,!1),p.setUint32(12,a,!1),p.setUint32(16,f,!1),p.setUint32(20,s,!1),p.setUint32(24,i,!1),p.setUint32(28,r,!1),D}function K(e){let t="";for(let n=0;n<e.length;n++)t+=(e[n]>>4).toString(16)+(e[n]&15).toString(16);return t}function b(e){return new TextEncoder().encode(e)}function I(e,t){e.length>64&&(e=A(e));let n=new Uint8Array(64);n.set(e);let o=new Uint8Array(64),a=new Uint8Array(64);for(let r=0;r<64;r++)o[r]=n[r]^54,a[r]=n[r]^92;let f=new Uint8Array(64+t.length);f.set(o),f.set(t,64);let s=A(f),i=new Uint8Array(96);return i.set(a),i.set(s,64),A(i)}function L(e,t){return K(I(b(e),b(t)))}function q(e){let t=new Uint8Array(e.length/2);for(let n=0;n<t.length;n++)t[n]=parseInt(e.substr(n*2,2),16);return t}function z(e,t){return K(I(q(e),b(t)))}var N="__CROWDSEC_POW_WORKER_PATH__",Q=4,X=44;function Y(){let e=typeof navigator<"u"&&navigator.hardwareConcurrency||1;return Math.max(1,Math.min(e,Q))}function Z(e){if(typeof e!="string"||e.length===0||e.length>X)return!1;for(let t=0;t<e.length;t++)if(e.charCodeAt(t)>127)return!1;return!0}function $(){try{return typeof fetch!="function"||typeof Blob!="function"||typeof URL>"u"||typeof URL.createObjectURL!="function"?Promise.resolve(null):fetch(N,{credentials:"same-origin"}).then(e=>e.ok?e.text():Promise.reject(new Error("pow worker http "+e.status))).then(e=>URL.createObjectURL(new Blob([e],{type:"text/javascript"}))).catch(()=>null)}catch{return Promise.resolve(null)}}function ee(e,t){return t<=0||t>64?Promise.resolve("0"):Z(e)?$().then(n=>j(n,e,t).catch(o=>n?j(null,e,t):Promise.reject(o))).catch(()=>te(e,t)):Promise.reject(new Error("pow: unusable salt"))}function j(e,t,n){let o=Y(),a=e||N;return new Promise((f,s)=>{let i=new Array(o).fill(null),r=!1,w=o,y=()=>{for(let u of i)if(u)try{u.terminate()}catch{}if(e)try{URL.revokeObjectURL(e)}catch{}};for(let u=0;u<o;u++){let x;try{x=new Worker(a)}catch{--w<=0&&!r&&(r=!0,y(),s(new Error("no pow worker")));continue}i[u]=x,x.onmessage=_=>{r||(r=!0,y(),f(_.data))},x.onerror=x.onmessageerror=()=>{if(!r){try{x.terminate()}catch{}i[u]=null,--w<=0&&(r=!0,y(),s(new Error("pow pool died")))}},x.postMessage({p:t,d:n,start:u,stride:o})}})}function te(e,t){let n=0;for(;;){let o=e+n.toString(36),a=A(b(o)),f=t>>3,s=t&7,i=!0;for(let r=0;r<f;r++)if(a[r]!==0){i=!1;break}if(i&&s>0){let r=255<<8-s&255;(a[f]&r)!==0&&(i=!1)}if(i)return n.toString(36);n++}}function ne(e,t){let n=b(e),o=b(t),a=new Uint8Array(o.length);for(let s=0;s<o.length;s++)a[s]=o[s]^n[s%n.length];let f=String.fromCharCode(...a);return btoa(f)}var B=typeof _ts<"u"?_ts:"",R=typeof _powP<"u"?_powP:"",oe=typeof _powM<"u"?_powM:"",W=typeof _powD<"u"?_powD:20,P=typeof _r<"u"?_r:"",re="__CROWDSEC_SUBMIT_PATH__";function m(e){if(typeof window.crowdsecSetChallengeStatus=="function"){window.crowdsecSetChallengeStatus(e);return}window.dispatchEvent(new CustomEvent("crowdsec-challenge-status",{detail:{status:e}}))}var ce="__CSEC_CHALLENGE_HOOK_v1__",se="__CSEC_CUSTOM_DETECT_v1__",ae=typeof _cjsT<"u"?_cjsT:500;async function ie(e){let t=globalThis[se];if(!Array.isArray(t)||t.length===0)return;let n=new Promise(o=>setTimeout(o,ae));for(let o of t)if(typeof o=="function")try{await Promise.race([Promise.resolve(o(e)),n])}catch{}try{e.fastBotDetection=Object.values(e.fastBotDetectionDetails).some(o=>o&&o.detected)}catch{}}async function fe(e){let t=globalThis.CrowdsecFingerprintScanner;if(typeof t!="function"){m("fail");return}let n,o;try{[n,o]=await Promise.all([ee(R,W),new t().collectFingerprint({encrypt:!1})])}catch{m("fail");return}await ie(o);let a=z(e,P),f=L(a,"fpenc"+P),s=ne(f,JSON.stringify(o)),i=L(a,P+B+n+s);return fetch(re,{method:"POST",credentials:"same-origin",body:new URLSearchParams({f:s,r:P,ts:B,sig:i,n,p:R,m:oe,d:W,u:window.location.pathname})}).then(r=>r.json()).then(r=>{let w=typeof r?.status=="string"?r.status:"fail";m(w)}).catch(()=>{m("fail")})}globalThis[ce]=function(e){if(!e||typeof e.key!="string"||e.key.length===0){m("fail");return}fe(e.key)};
diff --git a/pkg/appsec/challenge/js/obfuscate/index.wasm.gz b/pkg/appsec/challenge/js/obfuscate/index.wasm.gz
index 48324b80cbc..805d0d5e6e1 100644
Binary files a/pkg/appsec/challenge/js/obfuscate/index.wasm.gz and b/pkg/appsec/challenge/js/obfuscate/index.wasm.gz differ
diff --git a/pkg/appsec/challenge/js/obfuscate/obfuscate.js b/pkg/appsec/challenge/js/obfuscate/obfuscate.js
index 21846c7d1aa..d01ac6c70ca 100644
--- a/pkg/appsec/challenge/js/obfuscate/obfuscate.js
+++ b/pkg/appsec/challenge/js/obfuscate/obfuscate.js
@@ -24,11 +24,10 @@ try {
   const sourceCode = readStdin();
 
   // Spread the high-obfuscation preset, then add reservedStrings so the
-  // sentinel that bridges the static bundle and the per-epoch dynamic key
-  // module (CSEC_CHALLENGE_HOOK_v1) survives the string-array transform
-  // identically in both bundles. Without this, the two independently-
-  // obfuscated artifacts wouldn't agree on the globalThis symbol they
-  // need to meet at.
+  // sentinels bridging separately-built bundles survive the string-array
+  // transform identically in each;
+  //   CSEC_CHALLENGE_HOOK_v1 — static bundle <-> per-epoch dynamic key module
+  //   CSEC_CUSTOM_DETECT_v1  — static bundle <-> hub-shipped custom.js
   //
   // disableConsoleOutput is forced off because fpscanner's CDP detection
   // (signals/cdp.ts) relies on `console.log(err)` triggering DevTools'
@@ -40,7 +39,10 @@ try {
     {},
     JavaScriptObfuscator.getOptionsByPreset("high-obfuscation"),
     {
-      reservedStrings: ["__CSEC_CHALLENGE_HOOK_v1__"],
+      reservedStrings: [
+        "__CSEC_CHALLENGE_HOOK_v1__",
+        "__CSEC_CUSTOM_DETECT_v1__",
+      ],
       disableConsoleOutput: false,
     },
   );
diff --git a/pkg/appsec/challenge/pb/fingerprint.pb.go b/pkg/appsec/challenge/pb/fingerprint.pb.go
index af79cf3c169..d616e1242eb 100644
--- a/pkg/appsec/challenge/pb/fingerprint.pb.go
+++ b/pkg/appsec/challenge/pb/fingerprint.pb.go
@@ -31,8 +31,12 @@ type FingerprintData struct {
 	FastBotDetection        bool                                `protobuf:"varint,6,opt,name=fastBotDetection,proto3" json:"fastBotDetection,omitempty"`
 	FastBotDetectionDetails *FingerprintFastBotDetectionDetails `protobuf:"bytes,7,opt,name=fastBotDetectionDetails,proto3" json:"fastBotDetectionDetails,omitempty"`
 	Bot                     *FingerprintBotAlias                `protobuf:"bytes,8,opt,name=bot,proto3" json:"bot,omitempty"`
-	unknownFields           protoimpl.UnknownFields
-	sizeCache               protoimpl.SizeCache
+	// What the hub-distributed detection script reported. Bounded at decode and
+	// again before sealing (fingerprint_custom.go), since it is browser-supplied
+	// and would otherwise push the cookie past the size browsers guarantee.
+	Custom        map[string]*CustomValue `protobuf:"bytes,9,rep,name=custom,proto3" json:"custom,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *FingerprintData) Reset() {
@@ -121,6 +125,233 @@ func (x *FingerprintData) GetBot() *FingerprintBotAlias {
 	return nil
 }
 
+func (x *FingerprintData) GetCustom() map[string]*CustomValue {
+	if x != nil {
+		return x.Custom
+	}
+	return nil
+}
+
+// customValue is a tagged union over the shapes a detection script can produce.
+// A oneof, so "present and false" round-trips distinctly from "absent".
+type CustomValue struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Value:
+	//
+	//	*CustomValue_B
+	//	*CustomValue_S
+	//	*CustomValue_N
+	//	*CustomValue_Ss
+	//	*CustomValue_Ff
+	Value         isCustomValue_Value `protobuf_oneof:"value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CustomValue) Reset() {
+	*x = CustomValue{}
+	mi := &file_fingerprint_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CustomValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CustomValue) ProtoMessage() {}
+
+func (x *CustomValue) ProtoReflect() protoreflect.Message {
+	mi := &file_fingerprint_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CustomValue.ProtoReflect.Descriptor instead.
+func (*CustomValue) Descriptor() ([]byte, []int) {
+	return file_fingerprint_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CustomValue) GetValue() isCustomValue_Value {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+func (x *CustomValue) GetB() bool {
+	if x != nil {
+		if x, ok := x.Value.(*CustomValue_B); ok {
+			return x.B
+		}
+	}
+	return false
+}
+
+func (x *CustomValue) GetS() string {
+	if x != nil {
+		if x, ok := x.Value.(*CustomValue_S); ok {
+			return x.S
+		}
+	}
+	return ""
+}
+
+func (x *CustomValue) GetN() float64 {
+	if x != nil {
+		if x, ok := x.Value.(*CustomValue_N); ok {
+			return x.N
+		}
+	}
+	return 0
+}
+
+func (x *CustomValue) GetSs() *CustomStringList {
+	if x != nil {
+		if x, ok := x.Value.(*CustomValue_Ss); ok {
+			return x.Ss
+		}
+	}
+	return nil
+}
+
+func (x *CustomValue) GetFf() *CustomFloatList {
+	if x != nil {
+		if x, ok := x.Value.(*CustomValue_Ff); ok {
+			return x.Ff
+		}
+	}
+	return nil
+}
+
+type isCustomValue_Value interface {
+	isCustomValue_Value()
+}
+
+type CustomValue_B struct {
+	B bool `protobuf:"varint,1,opt,name=b,proto3,oneof"`
+}
+
+type CustomValue_S struct {
+	S string `protobuf:"bytes,2,opt,name=s,proto3,oneof"`
+}
+
+type CustomValue_N struct {
+	N float64 `protobuf:"fixed64,3,opt,name=n,proto3,oneof"`
+}
+
+type CustomValue_Ss struct {
+	Ss *CustomStringList `protobuf:"bytes,4,opt,name=ss,proto3,oneof"`
+}
+
+type CustomValue_Ff struct {
+	Ff *CustomFloatList `protobuf:"bytes,5,opt,name=ff,proto3,oneof"`
+}
+
+func (*CustomValue_B) isCustomValue_Value() {}
+
+func (*CustomValue_S) isCustomValue_Value() {}
+
+func (*CustomValue_N) isCustomValue_Value() {}
+
+func (*CustomValue_Ss) isCustomValue_Value() {}
+
+func (*CustomValue_Ff) isCustomValue_Value() {}
+
+type CustomStringList struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Values        []string               `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CustomStringList) Reset() {
+	*x = CustomStringList{}
+	mi := &file_fingerprint_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CustomStringList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CustomStringList) ProtoMessage() {}
+
+func (x *CustomStringList) ProtoReflect() protoreflect.Message {
+	mi := &file_fingerprint_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CustomStringList.ProtoReflect.Descriptor instead.
+func (*CustomStringList) Descriptor() ([]byte, []int) {
+	return file_fingerprint_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CustomStringList) GetValues() []string {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
+type CustomFloatList struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Values        []float64              `protobuf:"fixed64,1,rep,packed,name=values,proto3" json:"values,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CustomFloatList) Reset() {
+	*x = CustomFloatList{}
+	mi := &file_fingerprint_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CustomFloatList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CustomFloatList) ProtoMessage() {}
+
+func (x *CustomFloatList) ProtoReflect() protoreflect.Message {
+	mi := &file_fingerprint_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CustomFloatList.ProtoReflect.Descriptor instead.
+func (*CustomFloatList) Descriptor() ([]byte, []int) {
+	return file_fingerprint_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CustomFloatList) GetValues() []float64 {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
 // ChallengeCookie is the sealed cookie payload. It wraps the validated
 // fingerprint together with metadata that influences re-challenge decisions
 // (e.g. the PoW difficulty the client proved). Keeping this separate from
@@ -138,7 +369,7 @@ type ChallengeCookie struct {
 
 func (x *ChallengeCookie) Reset() {
 	*x = ChallengeCookie{}
-	mi := &file_fingerprint_proto_msgTypes[1]
+	mi := &file_fingerprint_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -150,7 +381,7 @@ func (x *ChallengeCookie) String() string {
 func (*ChallengeCookie) ProtoMessage() {}
 
 func (x *ChallengeCookie) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[1]
+	mi := &file_fingerprint_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -163,7 +394,7 @@ func (x *ChallengeCookie) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChallengeCookie.ProtoReflect.Descriptor instead.
 func (*ChallengeCookie) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{1}
+	return file_fingerprint_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ChallengeCookie) GetFingerprint() *FingerprintData {
@@ -195,7 +426,7 @@ type FingerprintSignals struct {
 
 func (x *FingerprintSignals) Reset() {
 	*x = FingerprintSignals{}
-	mi := &file_fingerprint_proto_msgTypes[2]
+	mi := &file_fingerprint_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -207,7 +438,7 @@ func (x *FingerprintSignals) String() string {
 func (*FingerprintSignals) ProtoMessage() {}
 
 func (x *FingerprintSignals) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[2]
+	mi := &file_fingerprint_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -220,7 +451,7 @@ func (x *FingerprintSignals) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintSignals.ProtoReflect.Descriptor instead.
 func (*FingerprintSignals) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{2}
+	return file_fingerprint_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *FingerprintSignals) GetAutomation() *FingerprintAutomation {
@@ -286,7 +517,7 @@ type FingerprintAutomation struct {
 
 func (x *FingerprintAutomation) Reset() {
 	*x = FingerprintAutomation{}
-	mi := &file_fingerprint_proto_msgTypes[3]
+	mi := &file_fingerprint_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -298,7 +529,7 @@ func (x *FingerprintAutomation) String() string {
 func (*FingerprintAutomation) ProtoMessage() {}
 
 func (x *FingerprintAutomation) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[3]
+	mi := &file_fingerprint_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -311,7 +542,7 @@ func (x *FingerprintAutomation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintAutomation.ProtoReflect.Descriptor instead.
 func (*FingerprintAutomation) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{3}
+	return file_fingerprint_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *FingerprintAutomation) GetWebdriver() bool {
@@ -371,7 +602,7 @@ type FingerprintDevice struct {
 
 func (x *FingerprintDevice) Reset() {
 	*x = FingerprintDevice{}
-	mi := &file_fingerprint_proto_msgTypes[4]
+	mi := &file_fingerprint_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -383,7 +614,7 @@ func (x *FingerprintDevice) String() string {
 func (*FingerprintDevice) ProtoMessage() {}
 
 func (x *FingerprintDevice) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[4]
+	mi := &file_fingerprint_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -396,7 +627,7 @@ func (x *FingerprintDevice) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintDevice.ProtoReflect.Descriptor instead.
 func (*FingerprintDevice) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{4}
+	return file_fingerprint_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *FingerprintDevice) GetCpuCount() int32 {
@@ -465,7 +696,7 @@ type FingerprintScreenResolution struct {
 
 func (x *FingerprintScreenResolution) Reset() {
 	*x = FingerprintScreenResolution{}
-	mi := &file_fingerprint_proto_msgTypes[5]
+	mi := &file_fingerprint_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -477,7 +708,7 @@ func (x *FingerprintScreenResolution) String() string {
 func (*FingerprintScreenResolution) ProtoMessage() {}
 
 func (x *FingerprintScreenResolution) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[5]
+	mi := &file_fingerprint_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -490,7 +721,7 @@ func (x *FingerprintScreenResolution) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintScreenResolution.ProtoReflect.Descriptor instead.
 func (*FingerprintScreenResolution) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{5}
+	return file_fingerprint_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *FingerprintScreenResolution) GetWidth() int32 {
@@ -567,7 +798,7 @@ type FingerprintMultimediaDevices struct {
 
 func (x *FingerprintMultimediaDevices) Reset() {
 	*x = FingerprintMultimediaDevices{}
-	mi := &file_fingerprint_proto_msgTypes[6]
+	mi := &file_fingerprint_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -579,7 +810,7 @@ func (x *FingerprintMultimediaDevices) String() string {
 func (*FingerprintMultimediaDevices) ProtoMessage() {}
 
 func (x *FingerprintMultimediaDevices) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[6]
+	mi := &file_fingerprint_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -592,7 +823,7 @@ func (x *FingerprintMultimediaDevices) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintMultimediaDevices.ProtoReflect.Descriptor instead.
 func (*FingerprintMultimediaDevices) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{6}
+	return file_fingerprint_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *FingerprintMultimediaDevices) GetSpeakers() int32 {
@@ -633,7 +864,7 @@ type FingerprintDeviceMediaQueries struct {
 
 func (x *FingerprintDeviceMediaQueries) Reset() {
 	*x = FingerprintDeviceMediaQueries{}
-	mi := &file_fingerprint_proto_msgTypes[7]
+	mi := &file_fingerprint_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -645,7 +876,7 @@ func (x *FingerprintDeviceMediaQueries) String() string {
 func (*FingerprintDeviceMediaQueries) ProtoMessage() {}
 
 func (x *FingerprintDeviceMediaQueries) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[7]
+	mi := &file_fingerprint_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -658,7 +889,7 @@ func (x *FingerprintDeviceMediaQueries) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintDeviceMediaQueries.ProtoReflect.Descriptor instead.
 func (*FingerprintDeviceMediaQueries) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{7}
+	return file_fingerprint_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *FingerprintDeviceMediaQueries) GetPrefersColorScheme() string {
@@ -734,7 +965,7 @@ type FingerprintDeviceKeyboard struct {
 
 func (x *FingerprintDeviceKeyboard) Reset() {
 	*x = FingerprintDeviceKeyboard{}
-	mi := &file_fingerprint_proto_msgTypes[8]
+	mi := &file_fingerprint_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -746,7 +977,7 @@ func (x *FingerprintDeviceKeyboard) String() string {
 func (*FingerprintDeviceKeyboard) ProtoMessage() {}
 
 func (x *FingerprintDeviceKeyboard) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[8]
+	mi := &file_fingerprint_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -759,7 +990,7 @@ func (x *FingerprintDeviceKeyboard) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintDeviceKeyboard.ProtoReflect.Descriptor instead.
 func (*FingerprintDeviceKeyboard) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{8}
+	return file_fingerprint_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *FingerprintDeviceKeyboard) GetLayout() string {
@@ -793,7 +1024,7 @@ type FingerprintBrowser struct {
 
 func (x *FingerprintBrowser) Reset() {
 	*x = FingerprintBrowser{}
-	mi := &file_fingerprint_proto_msgTypes[9]
+	mi := &file_fingerprint_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -805,7 +1036,7 @@ func (x *FingerprintBrowser) String() string {
 func (*FingerprintBrowser) ProtoMessage() {}
 
 func (x *FingerprintBrowser) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[9]
+	mi := &file_fingerprint_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -818,7 +1049,7 @@ func (x *FingerprintBrowser) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrowser.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowser) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{9}
+	return file_fingerprint_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *FingerprintBrowser) GetUserAgent() string {
@@ -894,7 +1125,7 @@ type FingerprintBrowserAI struct {
 
 func (x *FingerprintBrowserAI) Reset() {
 	*x = FingerprintBrowserAI{}
-	mi := &file_fingerprint_proto_msgTypes[10]
+	mi := &file_fingerprint_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -906,7 +1137,7 @@ func (x *FingerprintBrowserAI) String() string {
 func (*FingerprintBrowserAI) ProtoMessage() {}
 
 func (x *FingerprintBrowserAI) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[10]
+	mi := &file_fingerprint_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -919,7 +1150,7 @@ func (x *FingerprintBrowserAI) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrowserAI.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowserAI) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{10}
+	return file_fingerprint_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *FingerprintBrowserAI) GetSummarizerAvailability() string {
@@ -974,7 +1205,7 @@ type FingerprintBrowserFeatures struct {
 
 func (x *FingerprintBrowserFeatures) Reset() {
 	*x = FingerprintBrowserFeatures{}
-	mi := &file_fingerprint_proto_msgTypes[11]
+	mi := &file_fingerprint_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -986,7 +1217,7 @@ func (x *FingerprintBrowserFeatures) String() string {
 func (*FingerprintBrowserFeatures) ProtoMessage() {}
 
 func (x *FingerprintBrowserFeatures) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[11]
+	mi := &file_fingerprint_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -999,7 +1230,7 @@ func (x *FingerprintBrowserFeatures) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrowserFeatures.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowserFeatures) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{11}
+	return file_fingerprint_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *FingerprintBrowserFeatures) GetBitmask() string {
@@ -1225,7 +1456,7 @@ type FingerprintBrowserPlugins struct {
 
 func (x *FingerprintBrowserPlugins) Reset() {
 	*x = FingerprintBrowserPlugins{}
-	mi := &file_fingerprint_proto_msgTypes[12]
+	mi := &file_fingerprint_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1237,7 +1468,7 @@ func (x *FingerprintBrowserPlugins) String() string {
 func (*FingerprintBrowserPlugins) ProtoMessage() {}
 
 func (x *FingerprintBrowserPlugins) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[12]
+	mi := &file_fingerprint_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1250,7 +1481,7 @@ func (x *FingerprintBrowserPlugins) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrowserPlugins.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowserPlugins) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{12}
+	return file_fingerprint_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *FingerprintBrowserPlugins) GetIsValidPluginArray() bool {
@@ -1298,7 +1529,7 @@ type FingerprintBrowserExtensions struct {
 
 func (x *FingerprintBrowserExtensions) Reset() {
 	*x = FingerprintBrowserExtensions{}
-	mi := &file_fingerprint_proto_msgTypes[13]
+	mi := &file_fingerprint_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1310,7 +1541,7 @@ func (x *FingerprintBrowserExtensions) String() string {
 func (*FingerprintBrowserExtensions) ProtoMessage() {}
 
 func (x *FingerprintBrowserExtensions) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[13]
+	mi := &file_fingerprint_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1323,7 +1554,7 @@ func (x *FingerprintBrowserExtensions) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrowserExtensions.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowserExtensions) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{13}
+	return file_fingerprint_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *FingerprintBrowserExtensions) GetBitmask() string {
@@ -1356,7 +1587,7 @@ type FingerprintBrowserHighEntropyValues struct {
 
 func (x *FingerprintBrowserHighEntropyValues) Reset() {
 	*x = FingerprintBrowserHighEntropyValues{}
-	mi := &file_fingerprint_proto_msgTypes[14]
+	mi := &file_fingerprint_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1368,7 +1599,7 @@ func (x *FingerprintBrowserHighEntropyValues) String() string {
 func (*FingerprintBrowserHighEntropyValues) ProtoMessage() {}
 
 func (x *FingerprintBrowserHighEntropyValues) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[14]
+	mi := &file_fingerprint_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1381,7 +1612,7 @@ func (x *FingerprintBrowserHighEntropyValues) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use FingerprintBrowserHighEntropyValues.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowserHighEntropyValues) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{14}
+	return file_fingerprint_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *FingerprintBrowserHighEntropyValues) GetArchitecture() string {
@@ -1450,7 +1681,7 @@ type FingerprintBrandVersion struct {
 
 func (x *FingerprintBrandVersion) Reset() {
 	*x = FingerprintBrandVersion{}
-	mi := &file_fingerprint_proto_msgTypes[15]
+	mi := &file_fingerprint_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1462,7 +1693,7 @@ func (x *FingerprintBrandVersion) String() string {
 func (*FingerprintBrandVersion) ProtoMessage() {}
 
 func (x *FingerprintBrandVersion) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[15]
+	mi := &file_fingerprint_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1475,7 +1706,7 @@ func (x *FingerprintBrandVersion) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrandVersion.ProtoReflect.Descriptor instead.
 func (*FingerprintBrandVersion) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{15}
+	return file_fingerprint_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *FingerprintBrandVersion) GetBrand() string {
@@ -1502,7 +1733,7 @@ type FingerprintBrowserToSourceError struct {
 
 func (x *FingerprintBrowserToSourceError) Reset() {
 	*x = FingerprintBrowserToSourceError{}
-	mi := &file_fingerprint_proto_msgTypes[16]
+	mi := &file_fingerprint_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1514,7 +1745,7 @@ func (x *FingerprintBrowserToSourceError) String() string {
 func (*FingerprintBrowserToSourceError) ProtoMessage() {}
 
 func (x *FingerprintBrowserToSourceError) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[16]
+	mi := &file_fingerprint_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1527,7 +1758,7 @@ func (x *FingerprintBrowserToSourceError) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBrowserToSourceError.ProtoReflect.Descriptor instead.
 func (*FingerprintBrowserToSourceError) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{16}
+	return file_fingerprint_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *FingerprintBrowserToSourceError) GetToSourceError() string {
@@ -1555,7 +1786,7 @@ type FingerprintGraphics struct {
 
 func (x *FingerprintGraphics) Reset() {
 	*x = FingerprintGraphics{}
-	mi := &file_fingerprint_proto_msgTypes[17]
+	mi := &file_fingerprint_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1567,7 +1798,7 @@ func (x *FingerprintGraphics) String() string {
 func (*FingerprintGraphics) ProtoMessage() {}
 
 func (x *FingerprintGraphics) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[17]
+	mi := &file_fingerprint_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1580,7 +1811,7 @@ func (x *FingerprintGraphics) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintGraphics.ProtoReflect.Descriptor instead.
 func (*FingerprintGraphics) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{17}
+	return file_fingerprint_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *FingerprintGraphics) GetWebGL() *FingerprintGraphicsWebGL {
@@ -1614,7 +1845,7 @@ type FingerprintGraphicsWebGL struct {
 
 func (x *FingerprintGraphicsWebGL) Reset() {
 	*x = FingerprintGraphicsWebGL{}
-	mi := &file_fingerprint_proto_msgTypes[18]
+	mi := &file_fingerprint_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1626,7 +1857,7 @@ func (x *FingerprintGraphicsWebGL) String() string {
 func (*FingerprintGraphicsWebGL) ProtoMessage() {}
 
 func (x *FingerprintGraphicsWebGL) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[18]
+	mi := &file_fingerprint_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1639,7 +1870,7 @@ func (x *FingerprintGraphicsWebGL) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintGraphicsWebGL.ProtoReflect.Descriptor instead.
 func (*FingerprintGraphicsWebGL) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{18}
+	return file_fingerprint_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *FingerprintGraphicsWebGL) GetVendor() string {
@@ -1668,7 +1899,7 @@ type FingerprintGraphicsWebGPU struct {
 
 func (x *FingerprintGraphicsWebGPU) Reset() {
 	*x = FingerprintGraphicsWebGPU{}
-	mi := &file_fingerprint_proto_msgTypes[19]
+	mi := &file_fingerprint_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1680,7 +1911,7 @@ func (x *FingerprintGraphicsWebGPU) String() string {
 func (*FingerprintGraphicsWebGPU) ProtoMessage() {}
 
 func (x *FingerprintGraphicsWebGPU) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[19]
+	mi := &file_fingerprint_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1693,7 +1924,7 @@ func (x *FingerprintGraphicsWebGPU) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintGraphicsWebGPU.ProtoReflect.Descriptor instead.
 func (*FingerprintGraphicsWebGPU) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{19}
+	return file_fingerprint_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *FingerprintGraphicsWebGPU) GetVendor() string {
@@ -1734,7 +1965,7 @@ type FingerprintGraphicsCanvas struct {
 
 func (x *FingerprintGraphicsCanvas) Reset() {
 	*x = FingerprintGraphicsCanvas{}
-	mi := &file_fingerprint_proto_msgTypes[20]
+	mi := &file_fingerprint_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1746,7 +1977,7 @@ func (x *FingerprintGraphicsCanvas) String() string {
 func (*FingerprintGraphicsCanvas) ProtoMessage() {}
 
 func (x *FingerprintGraphicsCanvas) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[20]
+	mi := &file_fingerprint_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1759,7 +1990,7 @@ func (x *FingerprintGraphicsCanvas) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintGraphicsCanvas.ProtoReflect.Descriptor instead.
 func (*FingerprintGraphicsCanvas) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{20}
+	return file_fingerprint_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *FingerprintGraphicsCanvas) GetHasModifiedCanvas() bool {
@@ -1791,7 +2022,7 @@ type FingerprintCodecs struct {
 
 func (x *FingerprintCodecs) Reset() {
 	*x = FingerprintCodecs{}
-	mi := &file_fingerprint_proto_msgTypes[21]
+	mi := &file_fingerprint_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1803,7 +2034,7 @@ func (x *FingerprintCodecs) String() string {
 func (*FingerprintCodecs) ProtoMessage() {}
 
 func (x *FingerprintCodecs) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[21]
+	mi := &file_fingerprint_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1816,7 +2047,7 @@ func (x *FingerprintCodecs) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintCodecs.ProtoReflect.Descriptor instead.
 func (*FingerprintCodecs) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{21}
+	return file_fingerprint_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *FingerprintCodecs) GetAudioCanPlayTypeHash() string {
@@ -1878,7 +2109,7 @@ type FingerprintLocale struct {
 
 func (x *FingerprintLocale) Reset() {
 	*x = FingerprintLocale{}
-	mi := &file_fingerprint_proto_msgTypes[22]
+	mi := &file_fingerprint_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1890,7 +2121,7 @@ func (x *FingerprintLocale) String() string {
 func (*FingerprintLocale) ProtoMessage() {}
 
 func (x *FingerprintLocale) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[22]
+	mi := &file_fingerprint_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1903,7 +2134,7 @@ func (x *FingerprintLocale) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintLocale.ProtoReflect.Descriptor instead.
 func (*FingerprintLocale) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{22}
+	return file_fingerprint_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *FingerprintLocale) GetInternationalization() *FingerprintLocaleInternationalization {
@@ -1930,7 +2161,7 @@ type FingerprintLocaleInternationalization struct {
 
 func (x *FingerprintLocaleInternationalization) Reset() {
 	*x = FingerprintLocaleInternationalization{}
-	mi := &file_fingerprint_proto_msgTypes[23]
+	mi := &file_fingerprint_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1942,7 +2173,7 @@ func (x *FingerprintLocaleInternationalization) String() string {
 func (*FingerprintLocaleInternationalization) ProtoMessage() {}
 
 func (x *FingerprintLocaleInternationalization) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[23]
+	mi := &file_fingerprint_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1955,7 +2186,7 @@ func (x *FingerprintLocaleInternationalization) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use FingerprintLocaleInternationalization.ProtoReflect.Descriptor instead.
 func (*FingerprintLocaleInternationalization) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{23}
+	return file_fingerprint_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *FingerprintLocaleInternationalization) GetTimezone() string {
@@ -1982,7 +2213,7 @@ type FingerprintLocaleLanguages struct {
 
 func (x *FingerprintLocaleLanguages) Reset() {
 	*x = FingerprintLocaleLanguages{}
-	mi := &file_fingerprint_proto_msgTypes[24]
+	mi := &file_fingerprint_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1994,7 +2225,7 @@ func (x *FingerprintLocaleLanguages) String() string {
 func (*FingerprintLocaleLanguages) ProtoMessage() {}
 
 func (x *FingerprintLocaleLanguages) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[24]
+	mi := &file_fingerprint_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2007,7 +2238,7 @@ func (x *FingerprintLocaleLanguages) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintLocaleLanguages.ProtoReflect.Descriptor instead.
 func (*FingerprintLocaleLanguages) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{24}
+	return file_fingerprint_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *FingerprintLocaleLanguages) GetLanguages() []string {
@@ -2034,7 +2265,7 @@ type FingerprintContexts struct {
 
 func (x *FingerprintContexts) Reset() {
 	*x = FingerprintContexts{}
-	mi := &file_fingerprint_proto_msgTypes[25]
+	mi := &file_fingerprint_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2046,7 +2277,7 @@ func (x *FingerprintContexts) String() string {
 func (*FingerprintContexts) ProtoMessage() {}
 
 func (x *FingerprintContexts) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[25]
+	mi := &file_fingerprint_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2059,7 +2290,7 @@ func (x *FingerprintContexts) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintContexts.ProtoReflect.Descriptor instead.
 func (*FingerprintContexts) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{25}
+	return file_fingerprint_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *FingerprintContexts) GetIframe() *FingerprintIframeContext {
@@ -2090,7 +2321,7 @@ type FingerprintIframeContext struct {
 
 func (x *FingerprintIframeContext) Reset() {
 	*x = FingerprintIframeContext{}
-	mi := &file_fingerprint_proto_msgTypes[26]
+	mi := &file_fingerprint_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2102,7 +2333,7 @@ func (x *FingerprintIframeContext) String() string {
 func (*FingerprintIframeContext) ProtoMessage() {}
 
 func (x *FingerprintIframeContext) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[26]
+	mi := &file_fingerprint_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2115,7 +2346,7 @@ func (x *FingerprintIframeContext) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintIframeContext.ProtoReflect.Descriptor instead.
 func (*FingerprintIframeContext) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{26}
+	return file_fingerprint_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *FingerprintIframeContext) GetWebdriver() bool {
@@ -2175,7 +2406,7 @@ type FingerprintWebWorkerContext struct {
 
 func (x *FingerprintWebWorkerContext) Reset() {
 	*x = FingerprintWebWorkerContext{}
-	mi := &file_fingerprint_proto_msgTypes[27]
+	mi := &file_fingerprint_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2187,7 +2418,7 @@ func (x *FingerprintWebWorkerContext) String() string {
 func (*FingerprintWebWorkerContext) ProtoMessage() {}
 
 func (x *FingerprintWebWorkerContext) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[27]
+	mi := &file_fingerprint_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2200,7 +2431,7 @@ func (x *FingerprintWebWorkerContext) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintWebWorkerContext.ProtoReflect.Descriptor instead.
 func (*FingerprintWebWorkerContext) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{27}
+	return file_fingerprint_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *FingerprintWebWorkerContext) GetVendor() string {
@@ -2281,7 +2512,7 @@ type FingerprintFastBotDetectionDetails struct {
 
 func (x *FingerprintFastBotDetectionDetails) Reset() {
 	*x = FingerprintFastBotDetectionDetails{}
-	mi := &file_fingerprint_proto_msgTypes[28]
+	mi := &file_fingerprint_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2293,7 +2524,7 @@ func (x *FingerprintFastBotDetectionDetails) String() string {
 func (*FingerprintFastBotDetectionDetails) ProtoMessage() {}
 
 func (x *FingerprintFastBotDetectionDetails) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[28]
+	mi := &file_fingerprint_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2306,7 +2537,7 @@ func (x *FingerprintFastBotDetectionDetails) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use FingerprintFastBotDetectionDetails.ProtoReflect.Descriptor instead.
 func (*FingerprintFastBotDetectionDetails) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{28}
+	return file_fingerprint_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *FingerprintFastBotDetectionDetails) GetHeadlessChromeScreenResolution() *FingerprintDetectionResult {
@@ -2465,7 +2696,7 @@ type FingerprintDetectionResult struct {
 
 func (x *FingerprintDetectionResult) Reset() {
 	*x = FingerprintDetectionResult{}
-	mi := &file_fingerprint_proto_msgTypes[29]
+	mi := &file_fingerprint_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2477,7 +2708,7 @@ func (x *FingerprintDetectionResult) String() string {
 func (*FingerprintDetectionResult) ProtoMessage() {}
 
 func (x *FingerprintDetectionResult) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[29]
+	mi := &file_fingerprint_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2490,7 +2721,7 @@ func (x *FingerprintDetectionResult) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintDetectionResult.ProtoReflect.Descriptor instead.
 func (*FingerprintDetectionResult) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{29}
+	return file_fingerprint_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *FingerprintDetectionResult) GetDetected() bool {
@@ -2531,7 +2762,7 @@ type FingerprintBotAlias struct {
 
 func (x *FingerprintBotAlias) Reset() {
 	*x = FingerprintBotAlias{}
-	mi := &file_fingerprint_proto_msgTypes[30]
+	mi := &file_fingerprint_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2543,7 +2774,7 @@ func (x *FingerprintBotAlias) String() string {
 func (*FingerprintBotAlias) ProtoMessage() {}
 
 func (x *FingerprintBotAlias) ProtoReflect() protoreflect.Message {
-	mi := &file_fingerprint_proto_msgTypes[30]
+	mi := &file_fingerprint_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2556,7 +2787,7 @@ func (x *FingerprintBotAlias) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FingerprintBotAlias.ProtoReflect.Descriptor instead.
 func (*FingerprintBotAlias) Descriptor() ([]byte, []int) {
-	return file_fingerprint_proto_rawDescGZIP(), []int{30}
+	return file_fingerprint_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *FingerprintBotAlias) GetHeadlessChromeScreenResolution() bool {
@@ -2724,7 +2955,7 @@ var File_fingerprint_proto protoreflect.FileDescriptor
 
 const file_fingerprint_proto_rawDesc = "" +
 	"\n" +
-	"\x11fingerprint.proto\x12\vfingerprint\"\xe7\x02\n" +
+	"\x11fingerprint.proto\x12\vfingerprint\"\xfe\x03\n" +
 	"\x0fFingerprintData\x129\n" +
 	"\asignals\x18\x01 \x01(\v2\x1f.fingerprint.fingerprintSignalsR\asignals\x12\x12\n" +
 	"\x04fsid\x18\x02 \x01(\tR\x04fsid\x12\x14\n" +
@@ -2733,7 +2964,22 @@ const file_fingerprint_proto_rawDesc = "" +
 	"\x03url\x18\x05 \x01(\tR\x03url\x12*\n" +
 	"\x10fastBotDetection\x18\x06 \x01(\bR\x10fastBotDetection\x12i\n" +
 	"\x17fastBotDetectionDetails\x18\a \x01(\v2/.fingerprint.fingerprintFastBotDetectionDetailsR\x17fastBotDetectionDetails\x122\n" +
-	"\x03bot\x18\b \x01(\v2 .fingerprint.fingerprintBotAliasR\x03bot\"x\n" +
+	"\x03bot\x18\b \x01(\v2 .fingerprint.fingerprintBotAliasR\x03bot\x12@\n" +
+	"\x06custom\x18\t \x03(\v2(.fingerprint.FingerprintData.CustomEntryR\x06custom\x1aS\n" +
+	"\vCustomEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12.\n" +
+	"\x05value\x18\x02 \x01(\v2\x18.fingerprint.customValueR\x05value:\x028\x01\"\xa7\x01\n" +
+	"\vcustomValue\x12\x0e\n" +
+	"\x01b\x18\x01 \x01(\bH\x00R\x01b\x12\x0e\n" +
+	"\x01s\x18\x02 \x01(\tH\x00R\x01s\x12\x0e\n" +
+	"\x01n\x18\x03 \x01(\x01H\x00R\x01n\x12/\n" +
+	"\x02ss\x18\x04 \x01(\v2\x1d.fingerprint.customStringListH\x00R\x02ss\x12.\n" +
+	"\x02ff\x18\x05 \x01(\v2\x1c.fingerprint.customFloatListH\x00R\x02ffB\a\n" +
+	"\x05value\"*\n" +
+	"\x10customStringList\x12\x16\n" +
+	"\x06values\x18\x01 \x03(\tR\x06values\")\n" +
+	"\x0fcustomFloatList\x12\x16\n" +
+	"\x06values\x18\x01 \x03(\x01R\x06values\"x\n" +
 	"\x0fChallengeCookie\x12>\n" +
 	"\vfingerprint\x18\x01 \x01(\v2\x1c.fingerprint.FingerprintDataR\vfingerprint\x12%\n" +
 	"\x0epow_difficulty\x18\x02 \x01(\x05R\rpowDifficulty\"\xb7\x03\n" +
@@ -2997,96 +3243,104 @@ func file_fingerprint_proto_rawDescGZIP() []byte {
 	return file_fingerprint_proto_rawDescData
 }
 
-var file_fingerprint_proto_msgTypes = make([]protoimpl.MessageInfo, 31)
+var file_fingerprint_proto_msgTypes = make([]protoimpl.MessageInfo, 35)
 var file_fingerprint_proto_goTypes = []any{
 	(*FingerprintData)(nil),                       // 0: fingerprint.FingerprintData
-	(*ChallengeCookie)(nil),                       // 1: fingerprint.ChallengeCookie
-	(*FingerprintSignals)(nil),                    // 2: fingerprint.fingerprintSignals
-	(*FingerprintAutomation)(nil),                 // 3: fingerprint.fingerprintAutomation
-	(*FingerprintDevice)(nil),                     // 4: fingerprint.fingerprintDevice
-	(*FingerprintScreenResolution)(nil),           // 5: fingerprint.fingerprintScreenResolution
-	(*FingerprintMultimediaDevices)(nil),          // 6: fingerprint.fingerprintMultimediaDevices
-	(*FingerprintDeviceMediaQueries)(nil),         // 7: fingerprint.fingerprintDeviceMediaQueries
-	(*FingerprintDeviceKeyboard)(nil),             // 8: fingerprint.fingerprintDeviceKeyboard
-	(*FingerprintBrowser)(nil),                    // 9: fingerprint.fingerprintBrowser
-	(*FingerprintBrowserAI)(nil),                  // 10: fingerprint.fingerprintBrowserAI
-	(*FingerprintBrowserFeatures)(nil),            // 11: fingerprint.fingerprintBrowserFeatures
-	(*FingerprintBrowserPlugins)(nil),             // 12: fingerprint.fingerprintBrowserPlugins
-	(*FingerprintBrowserExtensions)(nil),          // 13: fingerprint.fingerprintBrowserExtensions
-	(*FingerprintBrowserHighEntropyValues)(nil),   // 14: fingerprint.fingerprintBrowserHighEntropyValues
-	(*FingerprintBrandVersion)(nil),               // 15: fingerprint.fingerprintBrandVersion
-	(*FingerprintBrowserToSourceError)(nil),       // 16: fingerprint.fingerprintBrowserToSourceError
-	(*FingerprintGraphics)(nil),                   // 17: fingerprint.fingerprintGraphics
-	(*FingerprintGraphicsWebGL)(nil),              // 18: fingerprint.fingerprintGraphicsWebGL
-	(*FingerprintGraphicsWebGPU)(nil),             // 19: fingerprint.fingerprintGraphicsWebGPU
-	(*FingerprintGraphicsCanvas)(nil),             // 20: fingerprint.fingerprintGraphicsCanvas
-	(*FingerprintCodecs)(nil),                     // 21: fingerprint.fingerprintCodecs
-	(*FingerprintLocale)(nil),                     // 22: fingerprint.fingerprintLocale
-	(*FingerprintLocaleInternationalization)(nil), // 23: fingerprint.fingerprintLocaleInternationalization
-	(*FingerprintLocaleLanguages)(nil),            // 24: fingerprint.fingerprintLocaleLanguages
-	(*FingerprintContexts)(nil),                   // 25: fingerprint.fingerprintContexts
-	(*FingerprintIframeContext)(nil),              // 26: fingerprint.fingerprintIframeContext
-	(*FingerprintWebWorkerContext)(nil),           // 27: fingerprint.fingerprintWebWorkerContext
-	(*FingerprintFastBotDetectionDetails)(nil),    // 28: fingerprint.fingerprintFastBotDetectionDetails
-	(*FingerprintDetectionResult)(nil),            // 29: fingerprint.fingerprintDetectionResult
-	(*FingerprintBotAlias)(nil),                   // 30: fingerprint.fingerprintBotAlias
+	(*CustomValue)(nil),                           // 1: fingerprint.customValue
+	(*CustomStringList)(nil),                      // 2: fingerprint.customStringList
+	(*CustomFloatList)(nil),                       // 3: fingerprint.customFloatList
+	(*ChallengeCookie)(nil),                       // 4: fingerprint.ChallengeCookie
+	(*FingerprintSignals)(nil),                    // 5: fingerprint.fingerprintSignals
+	(*FingerprintAutomation)(nil),                 // 6: fingerprint.fingerprintAutomation
+	(*FingerprintDevice)(nil),                     // 7: fingerprint.fingerprintDevice
+	(*FingerprintScreenResolution)(nil),           // 8: fingerprint.fingerprintScreenResolution
+	(*FingerprintMultimediaDevices)(nil),          // 9: fingerprint.fingerprintMultimediaDevices
+	(*FingerprintDeviceMediaQueries)(nil),         // 10: fingerprint.fingerprintDeviceMediaQueries
+	(*FingerprintDeviceKeyboard)(nil),             // 11: fingerprint.fingerprintDeviceKeyboard
+	(*FingerprintBrowser)(nil),                    // 12: fingerprint.fingerprintBrowser
+	(*FingerprintBrowserAI)(nil),                  // 13: fingerprint.fingerprintBrowserAI
+	(*FingerprintBrowserFeatures)(nil),            // 14: fingerprint.fingerprintBrowserFeatures
+	(*FingerprintBrowserPlugins)(nil),             // 15: fingerprint.fingerprintBrowserPlugins
+	(*FingerprintBrowserExtensions)(nil),          // 16: fingerprint.fingerprintBrowserExtensions
+	(*FingerprintBrowserHighEntropyValues)(nil),   // 17: fingerprint.fingerprintBrowserHighEntropyValues
+	(*FingerprintBrandVersion)(nil),               // 18: fingerprint.fingerprintBrandVersion
+	(*FingerprintBrowserToSourceError)(nil),       // 19: fingerprint.fingerprintBrowserToSourceError
+	(*FingerprintGraphics)(nil),                   // 20: fingerprint.fingerprintGraphics
+	(*FingerprintGraphicsWebGL)(nil),              // 21: fingerprint.fingerprintGraphicsWebGL
+	(*FingerprintGraphicsWebGPU)(nil),             // 22: fingerprint.fingerprintGraphicsWebGPU
+	(*FingerprintGraphicsCanvas)(nil),             // 23: fingerprint.fingerprintGraphicsCanvas
+	(*FingerprintCodecs)(nil),                     // 24: fingerprint.fingerprintCodecs
+	(*FingerprintLocale)(nil),                     // 25: fingerprint.fingerprintLocale
+	(*FingerprintLocaleInternationalization)(nil), // 26: fingerprint.fingerprintLocaleInternationalization
+	(*FingerprintLocaleLanguages)(nil),            // 27: fingerprint.fingerprintLocaleLanguages
+	(*FingerprintContexts)(nil),                   // 28: fingerprint.fingerprintContexts
+	(*FingerprintIframeContext)(nil),              // 29: fingerprint.fingerprintIframeContext
+	(*FingerprintWebWorkerContext)(nil),           // 30: fingerprint.fingerprintWebWorkerContext
+	(*FingerprintFastBotDetectionDetails)(nil),    // 31: fingerprint.fingerprintFastBotDetectionDetails
+	(*FingerprintDetectionResult)(nil),            // 32: fingerprint.fingerprintDetectionResult
+	(*FingerprintBotAlias)(nil),                   // 33: fingerprint.fingerprintBotAlias
+	nil,                                           // 34: fingerprint.FingerprintData.CustomEntry
 }
 var file_fingerprint_proto_depIdxs = []int32{
-	2,  // 0: fingerprint.FingerprintData.signals:type_name -> fingerprint.fingerprintSignals
-	28, // 1: fingerprint.FingerprintData.fastBotDetectionDetails:type_name -> fingerprint.fingerprintFastBotDetectionDetails
-	30, // 2: fingerprint.FingerprintData.bot:type_name -> fingerprint.fingerprintBotAlias
-	0,  // 3: fingerprint.ChallengeCookie.fingerprint:type_name -> fingerprint.FingerprintData
-	3,  // 4: fingerprint.fingerprintSignals.automation:type_name -> fingerprint.fingerprintAutomation
-	4,  // 5: fingerprint.fingerprintSignals.device:type_name -> fingerprint.fingerprintDevice
-	9,  // 6: fingerprint.fingerprintSignals.browser:type_name -> fingerprint.fingerprintBrowser
-	17, // 7: fingerprint.fingerprintSignals.graphics:type_name -> fingerprint.fingerprintGraphics
-	21, // 8: fingerprint.fingerprintSignals.codecs:type_name -> fingerprint.fingerprintCodecs
-	22, // 9: fingerprint.fingerprintSignals.locale:type_name -> fingerprint.fingerprintLocale
-	25, // 10: fingerprint.fingerprintSignals.contexts:type_name -> fingerprint.fingerprintContexts
-	5,  // 11: fingerprint.fingerprintDevice.screenResolution:type_name -> fingerprint.fingerprintScreenResolution
-	6,  // 12: fingerprint.fingerprintDevice.multimediaDevices:type_name -> fingerprint.fingerprintMultimediaDevices
-	7,  // 13: fingerprint.fingerprintDevice.mediaQueries:type_name -> fingerprint.fingerprintDeviceMediaQueries
-	8,  // 14: fingerprint.fingerprintDevice.keyboard:type_name -> fingerprint.fingerprintDeviceKeyboard
-	11, // 15: fingerprint.fingerprintBrowser.features:type_name -> fingerprint.fingerprintBrowserFeatures
-	12, // 16: fingerprint.fingerprintBrowser.plugins:type_name -> fingerprint.fingerprintBrowserPlugins
-	13, // 17: fingerprint.fingerprintBrowser.extensions:type_name -> fingerprint.fingerprintBrowserExtensions
-	14, // 18: fingerprint.fingerprintBrowser.highEntropyValues:type_name -> fingerprint.fingerprintBrowserHighEntropyValues
-	16, // 19: fingerprint.fingerprintBrowser.toSourceError:type_name -> fingerprint.fingerprintBrowserToSourceError
-	10, // 20: fingerprint.fingerprintBrowser.ai:type_name -> fingerprint.fingerprintBrowserAI
-	15, // 21: fingerprint.fingerprintBrowserHighEntropyValues.brands:type_name -> fingerprint.fingerprintBrandVersion
-	18, // 22: fingerprint.fingerprintGraphics.webGL:type_name -> fingerprint.fingerprintGraphicsWebGL
-	19, // 23: fingerprint.fingerprintGraphics.webgpu:type_name -> fingerprint.fingerprintGraphicsWebGPU
-	20, // 24: fingerprint.fingerprintGraphics.canvas:type_name -> fingerprint.fingerprintGraphicsCanvas
-	23, // 25: fingerprint.fingerprintLocale.internationalization:type_name -> fingerprint.fingerprintLocaleInternationalization
-	24, // 26: fingerprint.fingerprintLocale.languages:type_name -> fingerprint.fingerprintLocaleLanguages
-	26, // 27: fingerprint.fingerprintContexts.iframe:type_name -> fingerprint.fingerprintIframeContext
-	27, // 28: fingerprint.fingerprintContexts.webWorker:type_name -> fingerprint.fingerprintWebWorkerContext
-	29, // 29: fingerprint.fingerprintFastBotDetectionDetails.headlessChromeScreenResolution:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 30: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriver:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 31: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriverWritable:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 32: fingerprint.fingerprintFastBotDetectionDetails.hasSeleniumProperty:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 33: fingerprint.fingerprintFastBotDetectionDetails.hasCDP:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 34: fingerprint.fingerprintFastBotDetectionDetails.hasPlaywright:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 35: fingerprint.fingerprintFastBotDetectionDetails.hasImpossibleDeviceMemory:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 36: fingerprint.fingerprintFastBotDetectionDetails.hasHighCPUCount:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 37: fingerprint.fingerprintFastBotDetectionDetails.hasMissingChromeObject:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 38: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriverIframe:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 39: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriverWorker:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 40: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchWebGLInWorker:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 41: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchPlatformIframe:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 42: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchPlatformWorker:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 43: fingerprint.fingerprintFastBotDetectionDetails.hasSwiftshaderRenderer:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 44: fingerprint.fingerprintFastBotDetectionDetails.hasUTCTimezone:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 45: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchLanguages:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 46: fingerprint.fingerprintFastBotDetectionDetails.hasInconsistentEtsl:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 47: fingerprint.fingerprintFastBotDetectionDetails.hasBotUserAgent:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 48: fingerprint.fingerprintFastBotDetectionDetails.hasGPUMismatch:type_name -> fingerprint.fingerprintDetectionResult
-	29, // 49: fingerprint.fingerprintFastBotDetectionDetails.hasPlatformMismatch:type_name -> fingerprint.fingerprintDetectionResult
-	50, // [50:50] is the sub-list for method output_type
-	50, // [50:50] is the sub-list for method input_type
-	50, // [50:50] is the sub-list for extension type_name
-	50, // [50:50] is the sub-list for extension extendee
-	0,  // [0:50] is the sub-list for field type_name
+	5,  // 0: fingerprint.FingerprintData.signals:type_name -> fingerprint.fingerprintSignals
+	31, // 1: fingerprint.FingerprintData.fastBotDetectionDetails:type_name -> fingerprint.fingerprintFastBotDetectionDetails
+	33, // 2: fingerprint.FingerprintData.bot:type_name -> fingerprint.fingerprintBotAlias
+	34, // 3: fingerprint.FingerprintData.custom:type_name -> fingerprint.FingerprintData.CustomEntry
+	2,  // 4: fingerprint.customValue.ss:type_name -> fingerprint.customStringList
+	3,  // 5: fingerprint.customValue.ff:type_name -> fingerprint.customFloatList
+	0,  // 6: fingerprint.ChallengeCookie.fingerprint:type_name -> fingerprint.FingerprintData
+	6,  // 7: fingerprint.fingerprintSignals.automation:type_name -> fingerprint.fingerprintAutomation
+	7,  // 8: fingerprint.fingerprintSignals.device:type_name -> fingerprint.fingerprintDevice
+	12, // 9: fingerprint.fingerprintSignals.browser:type_name -> fingerprint.fingerprintBrowser
+	20, // 10: fingerprint.fingerprintSignals.graphics:type_name -> fingerprint.fingerprintGraphics
+	24, // 11: fingerprint.fingerprintSignals.codecs:type_name -> fingerprint.fingerprintCodecs
+	25, // 12: fingerprint.fingerprintSignals.locale:type_name -> fingerprint.fingerprintLocale
+	28, // 13: fingerprint.fingerprintSignals.contexts:type_name -> fingerprint.fingerprintContexts
+	8,  // 14: fingerprint.fingerprintDevice.screenResolution:type_name -> fingerprint.fingerprintScreenResolution
+	9,  // 15: fingerprint.fingerprintDevice.multimediaDevices:type_name -> fingerprint.fingerprintMultimediaDevices
+	10, // 16: fingerprint.fingerprintDevice.mediaQueries:type_name -> fingerprint.fingerprintDeviceMediaQueries
+	11, // 17: fingerprint.fingerprintDevice.keyboard:type_name -> fingerprint.fingerprintDeviceKeyboard
+	14, // 18: fingerprint.fingerprintBrowser.features:type_name -> fingerprint.fingerprintBrowserFeatures
+	15, // 19: fingerprint.fingerprintBrowser.plugins:type_name -> fingerprint.fingerprintBrowserPlugins
+	16, // 20: fingerprint.fingerprintBrowser.extensions:type_name -> fingerprint.fingerprintBrowserExtensions
+	17, // 21: fingerprint.fingerprintBrowser.highEntropyValues:type_name -> fingerprint.fingerprintBrowserHighEntropyValues
+	19, // 22: fingerprint.fingerprintBrowser.toSourceError:type_name -> fingerprint.fingerprintBrowserToSourceError
+	13, // 23: fingerprint.fingerprintBrowser.ai:type_name -> fingerprint.fingerprintBrowserAI
+	18, // 24: fingerprint.fingerprintBrowserHighEntropyValues.brands:type_name -> fingerprint.fingerprintBrandVersion
+	21, // 25: fingerprint.fingerprintGraphics.webGL:type_name -> fingerprint.fingerprintGraphicsWebGL
+	22, // 26: fingerprint.fingerprintGraphics.webgpu:type_name -> fingerprint.fingerprintGraphicsWebGPU
+	23, // 27: fingerprint.fingerprintGraphics.canvas:type_name -> fingerprint.fingerprintGraphicsCanvas
+	26, // 28: fingerprint.fingerprintLocale.internationalization:type_name -> fingerprint.fingerprintLocaleInternationalization
+	27, // 29: fingerprint.fingerprintLocale.languages:type_name -> fingerprint.fingerprintLocaleLanguages
+	29, // 30: fingerprint.fingerprintContexts.iframe:type_name -> fingerprint.fingerprintIframeContext
+	30, // 31: fingerprint.fingerprintContexts.webWorker:type_name -> fingerprint.fingerprintWebWorkerContext
+	32, // 32: fingerprint.fingerprintFastBotDetectionDetails.headlessChromeScreenResolution:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 33: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriver:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 34: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriverWritable:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 35: fingerprint.fingerprintFastBotDetectionDetails.hasSeleniumProperty:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 36: fingerprint.fingerprintFastBotDetectionDetails.hasCDP:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 37: fingerprint.fingerprintFastBotDetectionDetails.hasPlaywright:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 38: fingerprint.fingerprintFastBotDetectionDetails.hasImpossibleDeviceMemory:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 39: fingerprint.fingerprintFastBotDetectionDetails.hasHighCPUCount:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 40: fingerprint.fingerprintFastBotDetectionDetails.hasMissingChromeObject:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 41: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriverIframe:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 42: fingerprint.fingerprintFastBotDetectionDetails.hasWebdriverWorker:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 43: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchWebGLInWorker:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 44: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchPlatformIframe:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 45: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchPlatformWorker:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 46: fingerprint.fingerprintFastBotDetectionDetails.hasSwiftshaderRenderer:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 47: fingerprint.fingerprintFastBotDetectionDetails.hasUTCTimezone:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 48: fingerprint.fingerprintFastBotDetectionDetails.hasMismatchLanguages:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 49: fingerprint.fingerprintFastBotDetectionDetails.hasInconsistentEtsl:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 50: fingerprint.fingerprintFastBotDetectionDetails.hasBotUserAgent:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 51: fingerprint.fingerprintFastBotDetectionDetails.hasGPUMismatch:type_name -> fingerprint.fingerprintDetectionResult
+	32, // 52: fingerprint.fingerprintFastBotDetectionDetails.hasPlatformMismatch:type_name -> fingerprint.fingerprintDetectionResult
+	1,  // 53: fingerprint.FingerprintData.CustomEntry.value:type_name -> fingerprint.customValue
+	54, // [54:54] is the sub-list for method output_type
+	54, // [54:54] is the sub-list for method input_type
+	54, // [54:54] is the sub-list for extension type_name
+	54, // [54:54] is the sub-list for extension extendee
+	0,  // [0:54] is the sub-list for field type_name
 }
 
 func init() { file_fingerprint_proto_init() }
@@ -3094,13 +3348,20 @@ func file_fingerprint_proto_init() {
 	if File_fingerprint_proto != nil {
 		return
 	}
+	file_fingerprint_proto_msgTypes[1].OneofWrappers = []any{
+		(*CustomValue_B)(nil),
+		(*CustomValue_S)(nil),
+		(*CustomValue_N)(nil),
+		(*CustomValue_Ss)(nil),
+		(*CustomValue_Ff)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_fingerprint_proto_rawDesc), len(file_fingerprint_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   31,
+			NumMessages:   35,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/pkg/appsec/challenge/pb/fingerprint.proto b/pkg/appsec/challenge/pb/fingerprint.proto
index 05a072b120f..3dd66ca08bc 100644
--- a/pkg/appsec/challenge/pb/fingerprint.proto
+++ b/pkg/appsec/challenge/pb/fingerprint.proto
@@ -12,8 +12,28 @@ message FingerprintData {
   bool fastBotDetection = 6;
   fingerprintFastBotDetectionDetails fastBotDetectionDetails = 7;
   fingerprintBotAlias bot = 8;
+  // What the hub-distributed detection script reported. Bounded at decode and
+  // again before sealing (fingerprint_custom.go), since it is browser-supplied
+  // and would otherwise push the cookie past the size browsers guarantee.
+  map<string, customValue> custom = 9;
 }
 
+// customValue is a tagged union over the shapes a detection script can produce.
+// A oneof, so "present and false" round-trips distinctly from "absent".
+message customValue {
+  oneof value {
+    bool b = 1;
+    string s = 2;
+    double n = 3;
+    customStringList ss = 4;
+    customFloatList ff = 5;
+  }
+}
+
+message customStringList { repeated string values = 1; }
+
+message customFloatList { repeated double values = 1; }
+
 // ChallengeCookie is the sealed cookie payload. It wraps the validated
 // fingerprint together with metadata that influences re-challenge decisions
 // (e.g. the PoW difficulty the client proved). Keeping this separate from
diff --git a/pkg/appsec/challenge/testdata/realistic_fingerprint.json b/pkg/appsec/challenge/testdata/realistic_fingerprint.json
new file mode 100644
index 00000000000..02f41b0cbf2
--- /dev/null
+++ b/pkg/appsec/challenge/testdata/realistic_fingerprint.json
@@ -0,0 +1,238 @@
+{
+  "fastBotDetection": true,
+  "fastBotDetectionDetails": {
+    "hasCDP": {
+      "detected": true,
+      "severity": "high"
+    },
+    "hasHighCPUCount": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasImpossibleDeviceMemory": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasMismatchPlatformIframe": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasMismatchPlatformWorker": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasMismatchWebGLInWorker": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasMissingChromeObject": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasPlaywright": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasSeleniumProperty": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasSwiftshaderRenderer": {
+      "detected": false,
+      "severity": "low"
+    },
+    "hasUTCTimezone": {
+      "detected": false,
+      "severity": "medium"
+    },
+    "hasWebdriver": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasWebdriverIframe": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasWebdriverWorker": {
+      "detected": false,
+      "severity": "high"
+    },
+    "hasWebdriverWritable": {
+      "detected": false,
+      "severity": "high"
+    },
+    "headlessChromeScreenResolution": {
+      "detected": false,
+      "severity": "high"
+    }
+  },
+  "fsid": "FS1_00001000000000_00010h02ba_2304x1296c14m08b10011h-5db59_f1000111100e00000000p1100h-7ce12_0h06653c_1h-36e6b_en4h720e_0100h-156f8",
+  "nonce": "jb8t2jfm839",
+  "signals": {
+    "automation": {
+      "cdp": true,
+      "navigatorPropertyDescriptors": "00000",
+      "playwright": false,
+      "selenium": false,
+      "webdriver": false,
+      "webdriverWritable": false
+    },
+    "browser": {
+      "ai": {
+        "summarizerAvailability": "downloadable",
+        "summarizerLanguageAvailability": "available"
+      },
+      "etsl": 33,
+      "extensions": {
+        "bitmask": "00000000",
+        "extensions": []
+      },
+      "features": {
+        "applePaySupport": false,
+        "attachShadow": true,
+        "bitmask": "11111111111111111111111111111",
+        "brave": false,
+        "buffer": false,
+        "caches": true,
+        "chrome": true,
+        "opera": false,
+        "serial": true,
+        "showModalDialog": false,
+        "webAssembly": true
+      },
+      "highEntropyValues": {
+        "architecture": "arm",
+        "bitness": "64",
+        "brands": [
+          {
+            "brand": "Not(A:Brand",
+            "version": "8"
+          },
+          {
+            "brand": "Chromium",
+            "version": "144"
+          },
+          {
+            "brand": "Google Chrome",
+            "version": "144"
+          }
+        ],
+        "mobile": false,
+        "model": "",
+        "platform": "macOS",
+        "platformVersion": "26.2.0",
+        "uaFullVersion": "144.0.7559.133"
+      },
+      "maths": "67d0b556",
+      "plugins": {
+        "isValidPluginArray": true,
+        "pluginConsistency1": true,
+        "pluginCount": 5,
+        "pluginNamesHash": "-2cdc5c8b",
+        "pluginOverflow": false
+      },
+      "toSourceError": {
+        "hasToSource": false,
+        "toSourceError": "TypeError: Cannot read properties of null (reading usdfsh)"
+      },
+      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"
+    },
+    "codecs": {
+      "audioCanPlayTypeHash": "688c7345",
+      "audioMediaSourceHash": "-3cbc04a4",
+      "hasMediaSource": true,
+      "rtcAudioCapabilitiesHash": "26a15cc5",
+      "rtcVideoCapabilitiesHash": "4f24a817",
+      "videoCanPlayTypeHash": "-126cde82",
+      "videoMediaSourceHash": "-48c15d34"
+    },
+    "contexts": {
+      "iframe": {
+        "cpuCount": 14,
+        "language": "en",
+        "memory": 8,
+        "platform": "MacIntel",
+        "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36",
+        "webdriver": false
+      },
+      "webWorker": {
+        "cpuCount": 14,
+        "language": "en",
+        "memory": 8,
+        "platform": "MacIntel",
+        "renderer": "ANGLE (Apple, ANGLE Metal Renderer: Apple M4 Max, Unspecified Version)",
+        "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36",
+        "vendor": "Google Inc. (Apple)"
+      }
+    },
+    "device": {
+      "cpuCount": 14,
+      "keyboard": {
+        "layout": "Backquote,e Backslash,h BracketLeft,t BracketRight,t Comma,a Digit0,0 Digit1,1 Digit2,2 Digit3,3 Digit4,4 Digit5,5 Digit6,6 Digit7,7 Digit8,8 Digit9,9 Equal,l IntlBackslash,h KeyA,a KeyB,b KeyC,c KeyD,d KeyE,e KeyF,f KeyG,g KeyH,h KeyI,i KeyJ,j KeyK,k KeyL,l KeyM,m KeyN,n KeyO,o KeyP,p KeyQ,q KeyR,r KeyS,s KeyT,t KeyU,u KeyV,v KeyW,w KeyX,x KeyY,y KeyZ,z Minus,s Period,d Quote,e Semicolon,n Slash,h",
+        "layoutSize": 4
+      },
+      "mediaQueries": {
+        "anyHover": true,
+        "anyPointer": "fine",
+        "colorDepth": 10,
+        "colorGamut": "p3",
+        "hover": true,
+        "pointer": "fine",
+        "prefersColorScheme": "dark",
+        "prefersReducedMotion": false,
+        "prefersReducedTransparency": false
+      },
+      "memory": 8,
+      "multimediaDevices": {
+        "microphones": 1,
+        "speakers": 1,
+        "webcams": 1
+      },
+      "platform": "MacIntel",
+      "screenResolution": {
+        "availableHeight": 1265,
+        "availableWidth": 2304,
+        "colorDepth": 30,
+        "hasMultipleDisplays": true,
+        "height": 1296,
+        "innerHeight": 1144,
+        "innerWidth": 1444,
+        "pixelDepth": 30,
+        "width": 2304
+      }
+    },
+    "graphics": {
+      "canvas": {
+        "canvasFingerprint": "-421c84e0",
+        "hasModifiedCanvas": false
+      },
+      "webGL": {
+        "renderer": "ANGLE (Apple, ANGLE Metal Renderer: Apple M4 Max, Unspecified Version)",
+        "vendor": "Google Inc. (Apple)"
+      },
+      "webgpu": {
+        "architecture": "metal-3",
+        "description": "",
+        "device": "",
+        "vendor": "apple"
+      }
+    },
+    "locale": {
+      "internationalization": {
+        "localeLanguage": "en-US",
+        "timezone": "Europe/Paris"
+      },
+      "languages": {
+        "language": "en",
+        "languages": [
+          "en",
+          "en-US",
+          "fr-FR",
+          "fr"
+        ]
+      }
+    }
+  },
+  "time": 1770669806462,
+  "url": "https://example.com/some/product/page?ref=abc"
+}
\ No newline at end of file
diff --git a/pkg/appsec/challenge_customjs.go b/pkg/appsec/challenge_customjs.go
new file mode 100644
index 00000000000..7b0f342e8eb
--- /dev/null
+++ b/pkg/appsec/challenge_customjs.go
@@ -0,0 +1,112 @@
+// challenge_customjs.go resolves the browser-side detection modules an
+// appsec-config ships through the hub's `data:` mechanism:
+//
+//	data:
+//	  - source_url: https://hub-data.crowdsec.net/challenge/custom-v1.js
+//	    dest_file: challenge/custom.js
+//	    type: challenge-js
+//
+
+package appsec
+
+import (
+	"os"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge"
+	"github.com/crowdsecurity/crowdsec/pkg/cwhub"
+	"github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
+)
+
+// LoadCustomJS compiles the declared modules into the script served to the
+// browser.
+func (wc *AppsecConfig) LoadCustomJS(dataDir string) string {
+	detectors := wc.readCustomJS(dataDir)
+	if len(detectors) == 0 {
+		return ""
+	}
+
+	out, rejected := challenge.AssembleCustomJS(detectors)
+
+	// The page still renders and nothing at the HTTP layer shows a detector
+	// missing, so these lines are the only place a dropped one surfaces.
+	rejectedNames := make(map[string]bool, len(rejected))
+
+	for _, r := range rejected {
+		wc.Logger.Errorf("custom detection script %s rejected: %s", r.Name, r.Err)
+		rejectedNames[r.Name] = true
+	}
+
+	loaded := make([]string, 0, len(detectors)-len(rejected))
+
+	for _, d := range detectors {
+		if !rejectedNames[d.Name] {
+			loaded = append(loaded, d.Name)
+		}
+	}
+
+	// Nothing loaded: the per-script errors above already said why.
+	if len(loaded) == 0 {
+		return ""
+	}
+
+	// version ties this line to the runtime summary, so an operator can tell
+	// the two came from the same build.
+	wc.Logger.WithFields(log.Fields{
+		"scripts": strings.Join(loaded, ", "),
+		"bytes":   len(out),
+		"version": challenge.CustomJSVersion(out),
+	}).Infof("loaded %d custom detection scripts", len(loaded))
+
+	return out
+}
+
+// readCustomJS collects the declared modules in order. Read failures are
+// logged and skipped rather than returned, so one unreadable file costs only
+// its own detector.
+func (wc *AppsecConfig) readCustomJS(dataDir string) []challenge.Detector {
+	var (
+		detectors []challenge.Detector
+		seen      = make(map[string]bool)
+	)
+
+	for _, d := range wc.Data {
+		if d == nil || d.Type != exprhelpers.ChallengeJSDataType {
+			continue
+		}
+
+		if d.DestPath == "" {
+			wc.Logger.Errorf("missing dest_file for %s data in appsec-config %s", exprhelpers.ChallengeJSDataType, wc.Name)
+			continue
+		}
+
+		// esbuild resolves a module once per path, so a repeated dest_file
+		// would otherwise register the same hook twice.
+		if seen[d.DestPath] {
+			wc.Logger.Warnf("custom detection script %s declared more than once, ignoring the repeat", d.DestPath)
+			continue
+		}
+
+		path, err := cwhub.SafePath(dataDir, d.DestPath)
+		if err != nil {
+			wc.Logger.Errorf("invalid dest_file %q: %s", d.DestPath, err)
+			continue
+		}
+
+		content, err := os.ReadFile(path)
+		if err != nil {
+			wc.Logger.Errorf("unable to read custom detection script %s: %s", d.DestPath, err)
+			continue
+		}
+
+		seen[d.DestPath] = true
+
+		wc.Logger.Debugf("loaded custom detection script %s (%d bytes)", d.DestPath, len(content))
+
+		detectors = append(detectors, challenge.Detector{Name: d.DestPath, Source: string(content)})
+	}
+
+	return detectors
+}
diff --git a/pkg/appsec/challenge_customjs_test.go b/pkg/appsec/challenge_customjs_test.go
new file mode 100644
index 00000000000..5ef40243ab3
--- /dev/null
+++ b/pkg/appsec/challenge_customjs_test.go
@@ -0,0 +1,210 @@
+package appsec
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	logtest "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge"
+	"github.com/crowdsecurity/crowdsec/pkg/enrichment"
+	"github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
+)
+
+func challengeJSConfig(t *testing.T, files map[string]string, data ...*enrichment.DataProvider) (*AppsecConfig, string) {
+	t.Helper()
+
+	dataDir := t.TempDir()
+
+	for rel, content := range files {
+		path := filepath.Join(dataDir, rel)
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+		require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
+	}
+
+	return &AppsecConfig{
+		Name:   "test",
+		Data:   data,
+		Logger: log.NewEntry(log.StandardLogger()),
+	}, dataDir
+}
+
+func challengeJSData(dest string) *enrichment.DataProvider {
+	return &enrichment.DataProvider{DestPath: dest, Type: exprhelpers.ChallengeJSDataType}
+}
+
+func TestReadCustomJS(t *testing.T) {
+	tests := []struct {
+		name  string
+		files map[string]string
+		data  []*enrichment.DataProvider
+		want  []string // dest_file of each module, in order
+	}{
+		{
+			name:  "single script",
+			files: map[string]string{"challenge/custom.js": "hookA();"},
+			data:  []*enrichment.DataProvider{challengeJSData("challenge/custom.js")},
+			want:  []string{"challenge/custom.js"},
+		},
+		{
+			// A base detection bundle and a site-specific fix compose, and hook
+			// order follows the declaration order.
+			name:  "read in declaration order",
+			files: map[string]string{"challenge/a.js": "hookA()", "challenge/b.js": "hookB()"},
+			data:  []*enrichment.DataProvider{challengeJSData("challenge/a.js"), challengeJSData("challenge/b.js")},
+			want:  []string{"challenge/a.js", "challenge/b.js"},
+		},
+		{
+			// esbuild resolves a module once per path, so the repeat would
+			// register the same hook twice.
+			name:  "repeated dest_file read once",
+			files: map[string]string{"challenge/a.js": "hookA()"},
+			data:  []*enrichment.DataProvider{challengeJSData("challenge/a.js"), challengeJSData("challenge/a.js")},
+			want:  []string{"challenge/a.js"},
+		},
+		{
+			name:  "other data types ignored",
+			files: map[string]string{"legit_bots/gptbot.json": "{}", "crs/rules.conf": "SecRule"},
+			data: []*enrichment.DataProvider{
+				{DestPath: "legit_bots/gptbot.json", Type: "bots"},
+				{DestPath: "crs/rules.conf", Type: "modsec"},
+			},
+		},
+		{
+			// Bot detection has to survive a data file that hasn't downloaded.
+			name:  "missing file skipped",
+			files: map[string]string{"challenge/present.js": "hookB()"},
+			data:  []*enrichment.DataProvider{challengeJSData("challenge/absent.js"), challengeJSData("challenge/present.js")},
+			want:  []string{"challenge/present.js"},
+		},
+		{
+			name: "empty dest_file skipped",
+			data: []*enrichment.DataProvider{{Type: exprhelpers.ChallengeJSDataType}},
+		},
+		{
+			name: "no data at all",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg, dataDir := challengeJSConfig(t, tc.files, tc.data...)
+
+			var got []string
+			for _, d := range cfg.readCustomJS(dataDir) {
+				got = append(got, d.Name)
+			}
+
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// The point of compiling each module separately: one file that cannot be built
+// used to cost every other detector its registration.
+func TestLoadCustomJSDropsBrokenScript(t *testing.T) {
+	cfg, dataDir := challengeJSConfig(t,
+		map[string]string{
+			"challenge/broken.js": "export function collectSignals(fp) {\n",
+			"challenge/good.js":   "export function collectSignals(fp) { fp.custom = { ok: \"GOOD\" } }\n",
+		},
+		challengeJSData("challenge/broken.js"), challengeJSData("challenge/good.js"))
+
+	out := cfg.LoadCustomJS(dataDir)
+
+	require.NotEmpty(t, out)
+	assert.Contains(t, out, "GOOD")
+	assert.Contains(t, out, "__CSEC_CUSTOM_DETECT_v1__")
+}
+
+func TestLoadCustomJSRejectsTraversal(t *testing.T) {
+	cfg, dataDir := challengeJSConfig(t, nil, challengeJSData("../outside.js"))
+	require.NoError(t, os.WriteFile(filepath.Join(filepath.Dir(dataDir), "outside.js"), []byte("pwn()"), 0o600))
+
+	assert.Empty(t, cfg.readCustomJS(dataDir))
+}
+
+// Without the early return in FileInit, an unknown data type reaches
+// existsInFileMaps and errors, so every startup logs a spurious failure.
+func TestChallengeJSDataTypeIsNotExprData(t *testing.T) {
+	_, dataDir := challengeJSConfig(t, map[string]string{"challenge/custom.js": "not data, just JS\n"})
+
+	require.NoError(t, exprhelpers.FileInit(dataDir, "challenge/custom.js", exprhelpers.ChallengeJSDataType))
+}
+
+// custom_js_timeout has to load through LoadByPath, which is a strict unmarshal:
+// an unrecognized key there is a hard failure, not a warning.
+func TestChallengeCustomJSTimeoutLoadsFromConfig(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "cfg.yaml")
+
+	require.NoError(t, os.WriteFile(path, []byte(
+		"name: test/custom-js-timeout\nchallenge:\n  custom_js_timeout: 1500ms\n"), 0o600))
+
+	cfg, _ := challengeJSConfig(t, nil)
+	require.NoError(t, cfg.LoadByPath(path))
+
+	require.NotNil(t, cfg.Challenge)
+	require.NotNil(t, cfg.Challenge.CustomJSTimeout)
+	assert.Equal(t, 1500*time.Millisecond, *cfg.Challenge.CustomJSTimeout)
+}
+
+// Startup noise scales with the number of installed scripts unless the summary
+// is one line and the per-script detail sits at debug.
+func TestLoadCustomJSLogsOneSummary(t *testing.T) {
+	src := "export function collectSignals(fp) { fp.custom = { ok: true } }\n"
+
+	capture, hook := logtest.NewNullLogger()
+	capture.SetLevel(log.DebugLevel)
+
+	cfg, dataDir := challengeJSConfig(t,
+		map[string]string{"challenge/a.js": src, "challenge/b.js": src},
+		challengeJSData("challenge/a.js"), challengeJSData("challenge/b.js"))
+	cfg.Logger = log.NewEntry(capture)
+
+	out := cfg.LoadCustomJS(dataDir)
+	require.NotEmpty(t, out)
+
+	var (
+		infos  []*log.Entry
+		debugs int
+	)
+
+	for _, e := range hook.AllEntries() {
+		switch e.Level {
+		case log.InfoLevel:
+			infos = append(infos, e)
+		case log.DebugLevel:
+			debugs++
+		}
+	}
+
+	require.Len(t, infos, 1, "per-script detail belongs at debug")
+	require.Equal(t, 2, debugs)
+
+	// Declaration order is hook order, so the summary reports it as declared.
+	require.Equal(t, "challenge/a.js, challenge/b.js", infos[0].Data["scripts"])
+	require.Equal(t, challenge.CustomJSVersion(out), infos[0].Data["version"])
+}
+
+// Nothing served means nothing to summarize: the rejection error already named
+// the file, and a summary line here would claim a script the browser never gets.
+func TestLoadCustomJSAllRejected(t *testing.T) {
+	capture, hook := logtest.NewNullLogger()
+
+	cfg, dataDir := challengeJSConfig(t,
+		map[string]string{"challenge/broken.js": "export function collectSignals(fp) {\n"},
+		challengeJSData("challenge/broken.js"))
+	cfg.Logger = log.NewEntry(capture)
+
+	require.Empty(t, cfg.LoadCustomJS(dataDir))
+
+	for _, e := range hook.AllEntries() {
+		require.NotEqual(t, log.InfoLevel, e.Level, e.Message)
+	}
+}
diff --git a/pkg/appsec/score_log_test.go b/pkg/appsec/score_log_test.go
new file mode 100644
index 00000000000..dfe29d7bcd5
--- /dev/null
+++ b/pkg/appsec/score_log_test.go
@@ -0,0 +1,34 @@
+package appsec
+
+import (
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A rejection has to name the rules that produced the score. `signals` only
+// lists what fpscanner measured, so without this a score contributed by a
+// custom detection leaves no trace in the log at all.
+func TestWithRequestScoreAddsBreakdown(t *testing.T) {
+	state := &AppsecRequestState{}
+	state.RequestScore.Add(100, "realm_font_mismatch")
+	state.RequestScore.Add(30, "gpu_mismatch")
+
+	entry := withRequestScore(log.NewEntry(log.StandardLogger()), state)
+
+	require.Equal(t, 130, entry.Data["score"])
+	require.Equal(t, "realm_font_mismatch=100,gpu_mismatch=30", entry.Data["score_detail"])
+}
+
+// An unscored request must not gain empty fields.
+func TestWithRequestScoreNoopWhenEmpty(t *testing.T) {
+	base := log.NewEntry(log.StandardLogger())
+
+	got := withRequestScore(base, &AppsecRequestState{})
+
+	assert.Same(t, base, got)
+	assert.NotContains(t, got.Data, "score")
+	assert.NotContains(t, got.Data, "score_detail")
+}
diff --git a/pkg/appsec/waf_helpers.go b/pkg/appsec/waf_helpers.go
index 0ba3cdc152b..484607a3ad4 100644
--- a/pkg/appsec/waf_helpers.go
+++ b/pkg/appsec/waf_helpers.go
@@ -226,6 +226,18 @@ func GetOnChallengeEnv(ctx context.Context, w *AppsecRuntimeConfig, state *Appse
 	}
 }
 
+// withRequestScore decorates a logger with the score that has accumulated.
+func withRequestScore(logger *log.Entry, state *AppsecRequestState) *log.Entry {
+	if state.RequestScore.Empty() {
+		return logger
+	}
+
+	return logger.WithFields(log.Fields{
+		"score":        state.RequestScore.Total(),
+		"score_detail": state.RequestScore.String(),
+	})
+}
+
 // GetOnChallengeSubmitEnv is the env exposed to on_challenge_submit hooks.
 // Deliberately narrow: the hook fires once during the challenge submission
 // JSON response, so anything that would change the response shape
@@ -248,7 +260,7 @@ func GetOnChallengeSubmitEnv(w *AppsecRuntimeConfig, state *AppsecRequestState,
 			// nil-safe so an unexpected nil here is a no-op rather than
 			// a panic.
 			state.Fingerprint.LogRejected(
-				w.Logger,
+				withRequestScore(w.Logger, state),
 				log.InfoLevel,
 				request.ClientIP,
 				request.RemoteAddrNormalized,
@@ -267,7 +279,7 @@ func GetOnChallengeSubmitEnv(w *AppsecRuntimeConfig, state *AppsecRequestState,
 		// authored accept point is on a real challenge submission.
 		"LogAccepted": func(msg string, verbosity ...string) error {
 			state.Fingerprint.LogAccepted(
-				w.Logger,
+				withRequestScore(w.Logger, state),
 				log.InfoLevel,
 				request.ClientIP,
 				request.RemoteAddrNormalized,
diff --git a/pkg/exprhelpers/helpers.go b/pkg/exprhelpers/helpers.go
index 2ed7952585f..c2db20f7f24 100644
--- a/pkg/exprhelpers/helpers.go
+++ b/pkg/exprhelpers/helpers.go
@@ -196,6 +196,9 @@ func UpdateRegexpCacheMetrics() {
 	}
 }
 
+// ChallengeJSDataType marks the WAF challenge's custom detection script.
+const ChallengeJSDataType = "challenge-js"
+
 func FileInit(directory string, filename string, fileType string) error {
 	log.Debugf("init (folder:%s) (file:%s) (type:%s)", directory, filename, fileType)
 
@@ -210,6 +213,11 @@ func FileInit(directory string, filename string, fileType string) error {
 		return nil
 	}
 
+	if fileType == ChallengeJSDataType {
+		// Read off disk by the challenge runtime; nothing to index here.
+		return nil
+	}
+
 	ok, err := existsInFileMaps(filename, fileType)
 	if ok {
 		log.Debugf("ignored file %s%s because already loaded", directory, filename)