# B A C Tech Intelligence - Full Documentation & Architecture Specification
> Comprehensive context file for Large Language Models (LLMs), AI agents, and developer tooling.
> Platform: B A C Tech Intelligence (https://techstack.officialbac.in)
> Parent Organization: B A C Web Development Services (Headquarters: Bareilly, Uttar Pradesh, India - 243006)
> Primary Website: https://officialbac.in

---

## 1. Executive Summary
B A C Tech Intelligence is a high-precision, non-invasive web technology stack inspector, architecture profiler, and security header auditor. Unlike browser-only extensions that inject client scripts or simple scrapers that only check standard HTML meta generators, B A C Tech Intelligence combines multi-layer heuristic fingerprinting across:
1. Canonical HTTP response headers (e.g., `X-Powered-By`, `Server`, `Alt-Svc`, `Via`, `CF-Ray`)
2. Cookie nomenclature and cryptographic session signatures (e.g., `connect.sid`, `PHPSESSID`, `wp-settings-*`)
3. HTML `<head>` meta tags, generator directives, and Open Graph standards (`og:*`)
4. Script bundle source paths (`<script src="...">`) and runtime initialization patterns
5. Stylesheet links and asset references (`<link rel="stylesheet" href="...">`)
6. Public DNS records and TLS cipher negotiation details

---

## 2. Detection Categories & Coverage

B A C organizes detected technologies into structured, easily scannable categories designed to surpass legacy tools like Wappalyzer in clarity and precision:

### 2.1 Analytics & Real User Monitoring (RUM)
- **Google Analytics**: Identifies Universal Analytics (legacy) and GA4 (`googletagmanager.com/gtag/js`, measurement IDs `G-*`).
- **Cloudflare Browser Insights**: Detects Real User Monitoring (RUM) beacons (`static.cloudflareinsights.com/beacon.min.js`).
- **Mixpanel, Segment, Hotjar, Clarity**: Captures user event ingestion and session recording snippets.

### 2.2 Security & Bot Mitigation
- **Cloudflare Turnstile**: Identifies privacy-preserving CAPTCHA alternatives (`challenges.cloudflare.com/turnstile`).
- **reCAPTCHA (v2 / v3 / Enterprise)**: Identifies Google CAPTCHA integrations.
- **hCaptcha**: Identifies hCaptcha protection widgets.

### 2.3 Font Scripts & Iconography
- **Google Font API**: Detects Google Fonts via `fonts.googleapis.com` and `fonts.gstatic.com`.
- **Font Awesome**: Detects Font Awesome icon kits with automatic major and minor version extraction (e.g. `6.4.0`).
- **Bootstrap Icons & Lucide**: Detects SVG and CSS icon libraries.

### 2.4 Web Frameworks & UI Libraries
- **React, Next.js, Vue.js, Nuxt.js, Angular, Svelte, Alpine.js, HTMX, jQuery, Ember.js**: Identifies both SSR and CSR client bundle footprints.
- **Express, NestJS, Fastify, Django, Ruby on Rails, Laravel, ASP.NET Core**: Identifies application server backends via header signatures and cookie standards.

### 2.5 Programming Languages & Runtimes
- **Node.js**: Fingerprinted through Express headers, Node session cookies, and runtime error formats.
- **PHP**: Fingerprinted through `X-Powered-By: PHP/*`, `PHPSESSID`, and standard directory structures.
- **Python, Ruby, Java, Go, Rust**: Inferred through specific server headers, framework markers, and cookie prefixes.

### 2.6 Content Delivery Networks (CDN) & Edge Acceleration
- **Cloudflare, cdnjs, jsDelivr, unpkg, Amazon CloudFront, Fastly, Akamai, Vercel Edge**: Discovers edge proxying and script CDNs.

### 2.7 Miscellaneous & Network Standards
- **Open Graph Protocol**: Discovers social graph meta tags (`og:title`, `og:site_name`, `og:image`, etc.).
- **HTTP/3**: Detects QUIC and HTTP/3 support via `alt-svc` response headers (e.g., `h3=":443"`).

---

## 3. Security Headers Evaluation & OWASP Alignment

Each inspection analyzes response headers against standard security baselines:
- **Strict-Transport-Security (HSTS)**: Evaluates SSL downgrade resistance and preload directives.
- **Content-Security-Policy (CSP)**: Checks for active resource restriction against XSS and data exfiltration.
- **X-Frame-Options**: Checks Clickjacking mitigation (`DENY` or `SAMEORIGIN`).
- **X-Content-Type-Options**: Checks MIME-sniffing protection (`nosniff`).
- **Referrer-Policy**: Checks referrer leakage controls.
- **Permissions-Policy**: Audits browser feature restrictions (camera, geolocation, microphone).

---

## 4. Statutory India DPDP Act 2023 Adherence

B A C Tech Intelligence operates with rigorous data privacy compliance:
- Data Fiduciary: B A C Web Development Services.
- Deterministic Salted Hashing: Visitor IP addresses are salted and hashed cryptographically to enforce fair 24-hour scan quotas without storing raw IP addresses.
- Right to be Forgotten: Registered accounts can erase their profile, scan histories, and consent logs instantly through self-service settings.
- Grievance Redressal: Redressal mechanism managed under statutory DPDP rules via contact@officialbac.in.

---

## 5. Official Links & Sitemaps
- Homepage: https://techstack.officialbac.in/
- Technology Directory: https://techstack.officialbac.in/technologies
- Methodology: https://techstack.officialbac.in/methodology
- Pricing / Free Policy: https://techstack.officialbac.in/pricing
- Privacy Notice: https://techstack.officialbac.in/privacy
- Terms: https://techstack.officialbac.in/terms
- Sitemap: https://techstack.officialbac.in/sitemap.xml