Fix bot misdetection for Instagram webview on Pixel devices

[pepeladeira]

Summary by CodeRabbit

• Bug Fixes
  • Improved bot detection accuracy by filtering out known false-positive patterns in user agent strings. In-app webviews and similar browsers will no longer be incorrectly classified as bots, resulting in better experience consistency across different browsing contexts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Ready	Preview	May 11, 2026 1:52pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5c61e191-78c4-4f6e-804a-a8f50d867f7f

📥 Commits

Reviewing files that changed from the base of the PR and between 16b00ce and 45d8b0a.

📒 Files selected for processing (1)

• apps/web/lib/middleware/utils/detect-bot.ts

---

📝 Walkthrough

Walkthrough

The bot detection utility now pre-processes User-Agent strings to remove known false-positive patterns before applying bot classification heuristics. This reduces misclassification for edge cases like in-app webviews that append non-bot markers to their User-Agent.

Changes

Bot Detection False-Positive Filtering

Layer / File(s)	Summary
False-Positive Pattern Configuration apps/web/lib/middleware/utils/detect-bot.ts	UA_FALSE_POSITIVES regex constant is added to identify and strip User-Agent substrings (e.g., "Google/google") that resemble bot patterns but should not trigger bot detection.
Bot Detection Logic apps/web/lib/middleware/utils/detect-bot.ts	detectBot function sanitizes the incoming User-Agent by applying UA_FALSE_POSITIVES removal, then performs ua.isBot check and UA_BOTS pattern matching against the sanitized string.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A webview pretended to bot, but we saw through its shot,
False positives vanish with regex that glows,
detectBot now smarter, its judgment less fraught,
Sanitized User-Agents bloom where truth flows. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: fixing bot misdetection for Instagram webview on Pixel devices by sanitizing User-Agent strings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-instagram-pixel-bot-detection

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/web/lib/middleware/utils/bots-list.ts`:
- Around line 24-26: Bot detection lost coverage for several Google user agents
when "google" was removed; update the bots list in
apps/web/lib/middleware/utils/bots-list.ts by re-adding specific Google crawler
identifiers (e.g., "GoogleOther", "Google-InspectionTool", "Google-Read-Aloud",
"Google-Extended") alongside the existing "Mediapartners-Google" entry so those
UAs match, and update the adjacent comment to correct that AdsBot-Google is
matched via the generic "bot" pattern (not "fetch"). Ensure entries are
lowercase or rely on case-insensitive matching used elsewhere so they align with
the matcher behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a5799427-0190-4b9f-9f0d-667506c16d27

📥 Commits

Reviewing files that changed from the base of the PR and between 8f3632e and 16b00ce.

📒 Files selected for processing (1)

• apps/web/lib/middleware/utils/bots-list.ts