New Version 7.97
Several locations were discovered in the module that execute code in the console (JavaScript) without BAS_HIDE or BAS_SAFE protection. A remote server, via a proxy and GET request interceptors, can detect that some code was executed in the console. Even a simple, harmless document.ready.state (just to check whether the page has loaded or not).
Everything that BAS allowed was hidden, but 90% of CAPTCHA types (variants within a single CAPTCHA) did not use separate code for the console. Only within BAS actions, which are already hidden anyway.