This potential bug report turned into a really cool investigation with a surprising ending (shared with permission). So, @Plague_FPS was observing that Vercel BotID was detecting his own traffic as a bot. Further investigation shows that this was true for all Chromium browsers on his machine–but Firefox was working. Hmmm. How could this be? We went on a Zoom session with them, and eventually figured it out: A malware (or at least ultra-dark-pattern software) had installed a system proxy that was intercepting all network traffic. That proxy was triggering the BotID defenses. Uninstall the malware, and their Chromium browsers were passing again.
Where can I file issues for @vercel's botid package/api. I followed the documentation on the setup, and yet in production, all Server Action requests were being blocked. @rauchg @cramforce I was the one trigger the server actions in a preview build on Vercel, MS Edge browser.