If I use a firewall to block kbin in user agent then it doesn't matter what code is running, it will throw 403.

Edit: Just checked out, the first request with kbin user agent, it doesn't have x-powered-by: Express, suggesting that it is blocked in nginx level, it doesn't even reach the backend Express. This will not be reflected in the code whatsoever.

 ~  curl -I --user-agent "notKbinBot v0.1" https://lemmy.ml/u/test
HTTP/2 403
server: nginx
date: Wed, 28 Jun 2023 01:50:53 GMT
content-type: text/html
content-length: 146
vary: Accept-Encoding

 ~  curl -I --user-agent "placeholder-user-agent" https://lemmy.ml/u/test
HTTP/2 200
server: nginx
...
x-powered-by: Express
...