# Security What stops abuse, of us and of your numbers. | Threat | Defence | |---|---| | Floods of fake beacons | Per-IP, per-key and per-hostname rate limits; adaptive proof-of-work; quarantine | | Forged or replayed beacons | Server-owned session weight (always 1), plausibility checks, one stored session per id however often it is replayed, optional attested tickets | | Account farming | `POST /v1/accounts` needs proof-of-work or Turnstile; 5 per IP an hour, 3 per email a day | | Magic-link abuse | Single-use, 15 min, hashed at rest; the same answer whether or not the email exists | | Stolen secret key | Rotate in HQ (old key lives 24 h) or revoke now; keys are hashed at rest | | Cross-tenant reads | Every query is scoped to a site you're a member of; data routes 403 until verified | ## Rate limits | Route | Limit | |---|---| | Login | 3 per email per 15 min, 10 per IP an hour | | Magic-link verify | 20 per IP a minute; a token locks after 5 bad tries | | Accounts | 5 per IP an hour, 3 per email a day | | Collect | 60 per IP a minute, 10k per key a minute, 1k per keyless hostname a minute | | Check | 30 per IP a minute | | Data routes | 120 per session a minute | | Install check | 30 per IP a minute | Every limit returns `429` with `Retry-After`. IPs are hashed with a daily salt, never stored raw. ## Trust and quarantine Each beacon gets `trust` 0 to 1 from origin match, plausibility, IP reputation, proof-of-work and tickets. Below 0.4 it's stored as **unverified traffic**: visible in HQ, kept out of stats, priors, relabel and webhooks. ## Proof of work When a spike is detected the API publishes `DA-PoW: v=1;d=;nonce=` (response header and edge hint). The SDK solves SHA-256 over `sid|host|nonce|solution` in a worker; a missing answer quarantines, never drops. Default difficulty: 0. ## Attested tickets (optional) Your edge adapter adds `Server-Timing: da;desc="t="`, an HMAC derived from your secret key. The beacon echoes it; a valid ticket means high trust. See [Declared cover](/docs/cover) for edge hints.