Parent: OVERVIEW

WebVac is a powerful browser automation and crawl tool. Use it only against systems you are authorized to test or scrape. Unauthorized access, credential stuffing, or CDN/origin bypass without permission may be illegal.

Templates live under examples/ (*.example.*). Copy and rename locally.

Never pass long-lived API keys on the CLI in shared shell history if you can use capsolver.key instead.

Set WEBVAC_SESSION_KEY to enable Fernet encryption for saved storage_state files. Without it, session files are plaintext JSON on disk.

• Auth-wall pages are skipped by default — they are not “beaten” as WAF challenges.
• CapSolver spends money and interacts with third-party solver infrastructure; only enable keys you control.
• Managed Cloudflare interstitials often cannot be solved by CapSolver; do not assume auto-bypass.

If proxies.txt entries fail health-check, WebVac continues on your real IP and prints a warning. That is intentional availability behavior — treat it as an operational risk on sensitive targets.

Residential playbooks pin UA/geo for consistency; ensure your provider ToS allows automation.

Origin probing (Host header + IP fetch / Chromium MAP) is for authorized CDN-edge bypass scenarios only. It is not advertised as a casual CLI feature. Misuse can violate laws and vendor terms.

Default is bypass (--no-robots). Use --respect-robots when policy requires obedience. Bypassing robots does not grant legal permission.

Credential helpers redact passwords in logs where implemented. Still avoid printing full auth_creds.json or CapSolver keys into tickets/chat.

Network debug dumps may include request URLs and truncated bodies — treat network/*.json as sensitive.

• Patchright / Chromium — full browser attack surface
• CapSolver cloud API — third-party processing of sitekeys / page URLs
• De-Caffeinator submodule — separate Node toolchain; keep submodule updated deliberately

• AUTH
• CAPTCHA
• PROXY_ORIGIN
• CONFIG_REFERENCE