Journal

2026-03-25

2026-03-25

Signal

LinkedIn’s restriction of the automation account : triggered by 62+ rapid applications with sub-second delays : proved that behavioral detection systems classify automation not by what you do but by how fast you do it, and the fix is timing randomization, not action restriction.

Evidence

  • Project: projects/jobs-apply/_index : LinkedIn account restricted for “use of software that automates activity”
  • Root cause analysis: 62+ application attempts, sub-second delays, Tab-spamming, repeated click retries : identifiable behavioral fingerprint
  • Remediation plan: 10-iteration plan created (docs/LINKEDIN_REMEDIATION_PLAN.md); 12 prevention rules (Gaussian timing, daily caps, session limits, Bezier mouse movement)
  • Technical finding: LinkedIn Easy Apply modal rendered in shadow DOM inside preload iframe; page.evaluate(querySelectorAll) returns 0 elements; fixed by converting to Playwright locator() API (pierces open shadow DOM); CDP DOM.getDocument({ pierce: true }) for closed shadow DOM
  • Patterns captured: cdp-pierce-shadow-dom, gaussian-behavioral-timing

So What (Why Should You Care)

The LinkedIn restriction is a lesson in adversarial system design. Most automation detection systems don’t analyze what actions are performed : they analyze how they’re performed. Sub-second click timing, perfectly identical delays between every page transition, straight-line mouse movements, zero variation in any behavioral metric: these create a statistical profile that is essentially impossible for a human to replicate. Humans have high variance in their timing, mouse paths, and interaction patterns. Automation has low variance. That’s the signal the detection system is reading.

The fix isn’t to slow down the automation or reduce the daily volume. Both of those address the rate but not the distribution shape. The fix is to make the timing distribution human-shaped: Gaussian timing generates delays from a normal distribution centered around human-speed medians, so each action has different timing. Bezier mouse movement generates curved paths with natural acceleration and deceleration, so each mouse movement has different geometry.

The shadow DOM discovery today is a completely separate category of problem : a technical browser API issue rather than a behavioral detection issue. LinkedIn’s Easy Apply modal renders inside a closed shadow DOM in a preload iframe. Standard DOM queries (querySelectorAll) can’t pierce shadow DOM boundaries, so they return zero elements even when the modal is clearly visible. The fix (Playwright’s locator() API, which uses browser-native shadow DOM piercing) works for open shadow DOM. For closed shadow DOM, CDP DOM.getDocument({ pierce: true }) provides undetectable access at the protocol level.

Both problems today : behavioral detection and shadow DOM : represent the same underlying challenge: the target platform and the automation system are not cooperating. One is trying to prevent automation; the other is trying to perform it reliably. Understanding the specific mechanism the platform uses (behavioral statistics for detection; shadow DOM for UI isolation) is the prerequisite for finding the right technical response.

What’s Next

  • Validate Gaussian timing implementation before next LinkedIn run
  • LinkedIn restriction expires 2026-03-26 4:35 PM PDT : resume with all P0 measures active

Log

  • projects/jobs-apply/_index: LinkedIn account restricted for “use of software that automates activity”
  • Root cause: 62+ application attempts, sub-second delays, Tab-spamming, repeated click retries
  • Restriction expires 2026-03-26 4:35 PM PDT
  • Created 10-iteration remediation plan (docs/LINKEDIN_REMEDIATION_PLAN.md)
  • 12 prevention rules: Gaussian timing, daily caps, session limits, Bezier mouse movement
  • Shadow DOM discovery: LinkedIn Easy Apply modal in shadow DOM inside preload iframe
  • page.evaluate(querySelectorAll) finds 0 elements : can’t pierce shadow DOM
  • Fix: converted to Playwright locator() API (pierces open shadow DOM)
  • Discovered CDP DOM.getDocument({ pierce: true }) for closed shadow DOM
  • Website audit session with startup founder persona : identified visual improvements