@@ -415,6 +415,11 @@ def run_rule(spec: dict, ctx: dict) -> dict:
             last = control = None
             for _attempt in range(retest):
                 last = _run_probe(spec, client, route, oob_value)
+                if _bot_checked(last):
+                    # A firewall answered instead of the site, with a page that
+                    # differs on every request, so any differential would pass.
+                    out["detail"] = f"{_bot_checked(last)}'s bot check answered, not the site"
+                    break
                 control = (_control_response(client)
                            if spec["safety"] != "oob" else {})
                 oob_hit = bool(oob and token and oob.hit(token))
@@ -424,7 +429,7 @@ def run_rule(spec: dict, ctx: dict) -> dict:
                 else:
                     break
             if confirmations == retest and confirmations > 0:
-                out["findings"].append(_finding(spec, client, last, route))
+                out["findings"].append(_finding(spec, client, last, route, control))
                 break   # one solid finding per rule; the rest is noise
     except Refused as exc:
         out["status"] = "refused"
@@ -547,7 +552,7 @@ def _run_jwt(spec: dict, ctx: dict, domains, budget: Budget) -> list:
         # The endpoint must really be behind the session; the differential then
         # confirms, per attempt, that the forgery got the signed in response and
         # the signed out one did not, so a public page stays silent.
-        if resp_authed.get("status") != 200:
+        if resp_authed.get("status") != 200 or _bot_checked(resp_authed):
             continue
         resp_anon = anon.request("GET", path)
         for mode in modes:
@@ -623,13 +628,13 @@ def live(client, who, url):
             resp_b = live(b, "b", url)
             # It must be the second account's real object: a 200 that is not a
             # sign in or session expired wall.
-            if resp_b.get("status") != 200 or _looks_authless(resp_b):
+            if resp_b.get("status") != 200 or _looks_authless(resp_b) or _bot_checked(resp_b):
                 break
             resp_a = live(a, "a", url)
             resp_anon = anon.request("GET", url)
             # The first account must have reached the real object too; a sign in
             # wall is not access and there would be nothing to compare.
-            if _looks_authless(resp_a):
+            if _looks_authless(resp_a) or _bot_checked(resp_a):
                 resp_a = None
                 break
             env = _env_for(resp_a, {}, False,
@@ -976,7 +981,17 @@ def _run_probe(spec: dict, client: Client, route: str, oob_value: str) -> dict:
     return last
 
 
-def _finding(spec: dict, client: Client, response: dict, route: str) -> dict:
+def _bot_checked(resp) -> str:
+    """Whose bot check answered instead of the site, or empty."""
+    from app.core.external_probe import bot_check
+    resp = resp or {}
+    if resp.get("status") != 200:
+        return ""
+    return bot_check(resp.get("body") or "", 200)
+
+
+def _finding(spec: dict, client: Client, response: dict, route: str,
+             control: dict = None) -> dict:
     """A finding that stands on evidence, with how to repeat it and how to fix."""
     from app.core import dast_engines
 
@@ -985,9 +1000,16 @@ def _finding(spec: dict, client: Client, response: dict, route: str) -> dict:
         evidence = ("Confirmed by an out of band callback: the site was made to "
                     "reach our unique address, which proves it, and re-tested.")
     else:
+        got, ctl = response.get("status"), (control or {}).get("status")
+        if ctl and ctl != got:
+            told = f"and {ctl} for the control"
+        elif ctl:
+            told = "here, with a different page than the control's"
+        else:
+            told = "here"
         evidence = (f"Confirmed against a control (a request that cannot "
                     f"succeed) and re-tested.  The site answered status "
-                    f"{response.get('status')} here but not for the control.")
+                    f"{got} {told}.")
     f = dast_engines._finding(
         tool=f"rule:{spec['id']}", title=spec.get("title", spec["id"]),
         severity=spec.get("severity_floor", "medium"), url=url,
 
@@ -208,7 +208,11 @@ def verify(records: list, controls: dict, fetch, first=()) -> int:
         status = int(got.get("status") or 0)
         if rec.get("s") is None and status:
             rec["s"] = status
+        # A firewall's bot check changes on every request, so it never matches
+        # the control's page; it is still not the site's.
+        from app.core.external_probe import bot_check
         rec["r"] = (status == 200 and bool(got.get("body")) and
+                    not bot_check(got["body"], status) and
                     (control["status"] != 200 or fingerprint(got["body"]) != control["fp"]))
         rec.pop("v", None)
     return done
 
@@ -422,6 +422,9 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
     for e in skipped:
         limitations.append(f"{e.get('name') or e.get('tool')} did not complete: "
                            f"{e.get('detail') or e.get('status')}.")
+    for e in engines:
+        if e.get("status") == "warn" and e.get("tool") == "verify":
+            limitations.append(f"{e.get('name')}: {e.get('detail')}")
     if scan.authenticated:
         kinds = {"header": "a header", "cookie": "a session cookie", "form": "a form login"}
         signin = next((e for e in engines if e.get("tool") == "signin"), None)
 
@@ -2697,13 +2697,25 @@ def _builtin_run(scan_id, host, asset_id, profile, opts, auth, proxy) -> None:
     # Nothing an engine echoed back of the sign in is kept.
     findings = external_auth.redact(findings, secrets)
     engines = external_auth.redact(engines, secrets)
-    findings, dropped = drop_soft_404(findings, url, opts["allow_private"])
-    if dropped:
+    soft_stats = {}
+    findings, dropped = drop_soft_404(findings, url, opts["allow_private"], soft_stats)
+    challenged = soft_stats.get("challenged", 0)
+    if dropped - challenged:
+        n = dropped - challenged
         engines.append({"tool": "verify", "name": "Soft 404 check", "status": "ok",
                         "seconds": 0,
-                        "detail": f"left out {dropped} finding{'s' if dropped != 1 else ''} "
+                        "detail": f"left out {n} finding{'s' if n != 1 else ''} "
                                   "for paths that answer not found, or with the same "
                                   "page as one that cannot exist"})
+    if challenged:
+        engines.append({"tool": "verify", "name": "Bot check", "status": "warn",
+                        "seconds": 0,
+                        "detail": f"left out {challenged} finding"
+                                  f"{'s' if challenged != 1 else ''} for paths that "
+                                  f"answered with {soft_stats['bot_check']}'s bot check "
+                                  "page instead of the site.  The scan did not reach "
+                                  "the application there.  Let the scanner through the "
+                                  "firewall, or scan the origin, for a real result."})
     csp = (base["telemetry"].get("headers") or {}).get("content-security-policy", "")
     findings, lowered = soften_blocked_xss(findings, csp)
     if lowered:
@@ -2763,7 +2775,8 @@ def _builtin_run(scan_id, host, asset_id, profile, opts, auth, proxy) -> None:
                        r"|CWE-79\b|CWE-113\b", re.I)
 
 
-def drop_soft_404(findings: list, base_url: str, allow_private: bool = False) -> tuple:
+def drop_soft_404(findings: list, base_url: str, allow_private: bool = False,
+                  stats: dict = None) -> tuple:
     """Leave out path findings whose page is the site's not found page.
 
     One request to an address that cannot exist gives the site's answer for
@@ -2828,13 +2841,27 @@ def same(a: str, a_cut: bool, b: str, b_cut: bool) -> bool:
             body, cut = got["body"], len(got["body"]) >= SOFT_404_BODY
             loc = got["headers"].get("location", "")
             to_login = 300 <= got["status"] < 400 and bool(_LOGIN_URL.search(loc))
-            seen[url] = (got["status"], to_login, got["status"] == 200 and any(
+            # A firewall's bot check ("Are you human?") answers in place of
+            # the site, with a page that changes on every request, so it never
+            # matches the control.  The path was not reached at all.
+            challenge = (external_probe.bot_check(body, got["status"])
+                         if got["status"] == 200 else "")
+            seen[url] = (got["status"], to_login, challenge, got["status"] == 200 and any(
                 same(norm(body, *echoed), cut, mark, mark_cut)
                 # Bodies cut at the limit all have its length, so only a
                 # whole page can be matched on size.
                 or html and not (cut or mark_cut) and abs(len(body) - size) < 16
                 for mark, size, mark_cut in controls))
-        status, to_login, soft = seen[url]
+        status, to_login, challenge, soft = seen[url]
+        if challenge:
+            # Nothing the scanner said about this address is about the site:
+            # not that a file is there, and not what the page holds, which is
+            # the firewall's own page.
+            dropped += 1
+            if stats is not None:
+                stats["bot_check"] = challenge
+                stats["challenged"] = stats.get("challenged", 0) + 1
+            continue
         # Nothing is there: a claim that a file or page was found is only the
         # site's not found page.  What the page itself carries stays: input
         # it echoes back, or a key in it, is on the 404 page too.
 
@@ -69,7 +69,7 @@
     <tbody>
     {% for e in view.engines %}
       <tr><td>{{ e.name }}</td>
-        <td class="small"><span class="badge {{ {'ok':'ok','skipped':'waived','failed':'critical','timeout':'pending','stopped':'pending'}.get(e.status, 'info') }}">{{ e.status }}</span> {{ e.detail }}{% if e.reached %}<span class="faint">, {{ e.reached | thousands }} address{{ '' if e.reached == 1 else 'es' }} answered</span>{% endif %}{% if e.requests %}<span class="faint">, {{ e.requests | thousands }} request{{ '' if e.requests == 1 else 's' }} sent</span>{% endif %}
+        <td class="small"><span class="badge {{ {'ok':'ok','skipped':'waived','failed':'critical','timeout':'pending','stopped':'pending','warn':'high'}.get(e.status, 'info') }}">{{ e.status }}</span> {{ e.detail }}{% if e.reached %}<span class="faint">, {{ e.reached | thousands }} address{{ '' if e.reached == 1 else 'es' }} answered</span>{% endif %}{% if e.requests %}<span class="faint">, {{ e.requests | thousands }} request{{ '' if e.requests == 1 else 's' }} sent</span>{% endif %}
           {% for r in e.repos or [] %}<div class="faint">{{ r.repository }}{% if r.branch %} ({{ r.branch }}){% endif %}: {{ r.routes }} routes{% if r.host_in_code %}, host named in {{ r.host_in_code | join(', ') }}{% endif %}{% if r.error %}, {{ r.error }}{% endif %}</div>{% endfor %}</td>
         <td class="small nowrap">{{ e.seconds // 60 }}m {{ e.seconds % 60 }}s</td></tr>
     {% endfor %}
 
@@ -4,6 +4,19 @@ Newest first.  Written for somebody deciding whether to upgrade, so every entry
 says what is different for a person using the product rather than which files
 moved.
 
+## 2026-11-11
+
+**A firewall's bot check is no longer reported as findings.**  Some firewalls,
+Oracle Zenedge among them, answer every address with a 200 "Are you human?"
+page that changes size on every request.  The not found check never matched
+it, so nikto reported hundreds of files that were not there, and curated rules
+called GraphQL, Swagger and ColdFusion pages confirmed.  Now an address that
+answers with a known bot check page is left out, it is not counted as reached,
+and a curated rule never confirms on one.  The scan page and the PDF say how
+many were left out and that the scan did not reach the application.  A
+curated rule's evidence now gives the control's real status.  Scans that ran
+before this keep their findings; scan the site again.
+
 ## 2026-11-10
 
 **Record a session.**  A site behind a bot check, or behind single sign on,