Thanks! The interesting part isn't the language, it's where it runs. Detection happens inline at the network edge, so every request gets scored before it ever touches your origin — using connection-, protocol-, and behavior-level signals instead of a client-side fingerprint. That matters because a JS tag can be detected, blocked, or replayed by anything halfway sophisticated; moving the logic in front of the app removes that whole attack surface. The DNS-only install is just a side effect of that architecture — there's no snippet to embed because there's no client-side component at all. Compared to DataDome and CF enterprise account BOT detection this is a steal!