Hyper Solutions founder Patrick van den Bosch on browserless bypasses, session consistency, AI-assisted reverse engineering and the economics of solving at scale.
Akamai, DataDome, Incapsula and Kasada each ship JavaScript that inspects the visiting client, encodes what it finds and sends it back to be judged. Much of that code is heavily obfuscated, and some of it runs inside a custom virtual machine designed to keep it unreadable.
Reverse engineering one of these systems means working out what the script collects, how it encodes it, and which values the server actually checks. Then the vendor ships a new build, and on some systems that happens daily.
Patrick van den Bosch and his team have been working through that cycle since 2020. He is the founder of Hyper Solutions, which builds request-based solutions for all four vendors. During our recent Reddit AMA, he described where his team's time really goes:
Most of the time is usually spent testing, understanding how the antibot updates and how to maintain it at scale.
The Hyper Solutions team started out as sneaker developers. According to the company, its API now handles more than 2.5 billion requests a month.
In our thirteenth r/WebScrapingInsider AMA, we asked Patrick how he approaches an unfamiliar protection, why bypasses that work in testing fail later, where AI helps, and how to judge whether a bypass is worth the cost.
Here are the nine biggest lessons from the discussion.