Add Hackle detection

[hellolimo-hackle]

Add Hackle detection

Adds a fingerprint for Hackle, an experimentation and growth platform (A/B testing, feature flags, product analytics, behavioral messaging). It is widely adopted in South Korea and is currently not detected by this ruleset, while comparable tools (Optimizely, VWO, AB Tasty, Amplitude) are.

Disclosure: I work at Hackle. Every marker below was observed on a live third-party site in a real browser, not copied from internal documentation.

Categories

74 A/B Testing · 85 Feature management · 10 Analytics · 32 Marketing automation · 53 CRM

Verified sites

The SDK ships in several shapes (snippet, UMD build, GTM build, Cafe24 storefront plugin), so markers were verified across all of them.

Site	Marker observed
https://kmong.com	window.hackleClient
https://www.inflearn.com	window.hackleClient
https://store.hanssem.com	window._hackle, window.hackleClient, fastly.jsdelivr.net/npm/@hackler/javascript-sdk@11.56.0
https://www.webtour.com	window._hackle, cdn2.hackle.io/npm/@hackler/javascript-sdk@11.39.0
https://dailychips.net	window.Hackle, window.hackleClient, window._hackle, cdn2.hackle.io/npm/@hackler/javascript-sdk@11.38.0
https://www.anderssonbell.com	window.Hackle, window.hackleClient, cdn2.hackle.io/npm/@hackler/javascript-sdk@11.36.0
https://lilyeve.kr	window.HacklePlugin, window._hackleCafe24App, static.hackle.io/sdk/cafe24/plugin/0.0.10/bridge.js
https://celimax.co.kr	window.HacklePlugin, window.HACKLE_PRELOAD_CLIENT, window.hackleClient, static.hackle.io/sdk/cafe24/plugin/0.0.10/
https://abib.com	window.HacklePlugin, window._hackleCafe24App, window.HACKLE_PRELOAD_CLIENT, static.hackle.io/sdk/cafe24/plugin/0.0.3/bridge.js
https://boho.care	window.HacklePlugin, static.hackle.io/sdk/cafe24/plugin/0.0.9/bridge.js
https://spartaclub.kr	HACKLE_SDK_KEY in HTML
https://www.vigloo.com	requests to sdk-api.hackle.io, event-api.hackle.io (matches xhr only)
https://www.plabfootball.com	requests to sdk-api.hackle.io, event-api.hackle.io (matches xhr only)

Notes on the marker choices

Six JS globals, not one. The global depends on the install path: hackleClient (snippet), Hackle (UMD build), _hackle (GTM build), HacklePlugin / _hackleCafe24App / HACKLE_PRELOAD_CLIENT (Cafe24 storefront plugin). Matching only hackleClient misses webtour.com and every Cafe24 storefront.

@hackler/javascript-sdk — note the hackler spelling. It is the npm package name, so it matches regardless of CDN (jsDelivr, cdn2.hackle.io, self-hosted mirrors) and yields the version. A hackle.io-only pattern misses sites loading the SDK from jsDelivr, such as store.hanssem.com.

xhr is host-scoped rather than \.hackle\.io. A broad domain pattern also matches docs.hackle.io, the vendor's documentation site, which does not load the SDK — verified: no globals, no script tags, detection came only from same-origin requests. The scoped list covers every SDK endpoint observed.

xhr will rarely fire in practice and is only a fallback. The SDK bundle (@hackler/javascript-sdk@11.56.0) has 1 XMLHttpRequest, 4 fetch( and 5 sendBeacon call sites, and Chrome does not classify the latter two as xhr. Detection is carried by js, scriptSrc and html; the two sites at the bottom of the table above are the ones that depend on this fallback.

Only one html pattern, deliberately. Integration-code strings double as documentation strings. Four candidates were tested against the vendor's own docs and two were dropped after they matched:

• Hackle\.createInstance\( — 12 matches on docs.hackle.io/en/development-guide/javascript
• hackleClient\.track\( — matches the code sample on docs.hackle.io/development-guide/quick-start

HACKLE_SDK_KEY was checked against the same pages and does not appear. hackle.io/ko/blog does not match any pattern in this fingerprint. hackle.io itself is detected because it genuinely runs the SDK.

Icon

Hackle.png, 32×32, from the official favicon.

---

🤖 Generated with Claude Code