User-Agent Parser

Never treat the UA as a security signal

The UA string is **self-reported** by the client and can be forged by anyone. Browsers also mimic each other for compatibility: Edge contains Chrome, Chrome contains Safari, and on iOS every browser contains Safari. These conclusions are only good for statistics and troubleshooting — logic like "reject visitors whose UA lacks Mobile" stops no attacker and hurts real users who changed their UA.