Fail the build, not the ban rate A fingerprint regression is invisible until something starts rejecting the traffic weeks later. turns it into a diff in a pull request: scan, save the JSON, compare the next run against the saved baseline. Node 22 or newer, a Chromium in the image, zero runtime dependencies. Runner note: give the container enough shared memory ( on Docker, or a mount) and the capabilities Chrome's own sandbox needs. Leave the browser sandbox enabled; a scan that will not start is an image problem to fix in the image. The two mechanisms Absolute floor. Exits 1 when the score is…