Security

What stops abuse, of us and of your numbers.

Threat	Defence
Floods of fake beacons	Per-IP, per-key and per-hostname rate limits; adaptive proof-of-work; quarantine
Forged or replayed beacons	Server-owned session weight (always 1), plausibility checks, one stored session per id however often it is replayed, optional attested tickets
Account farming	`POST /v1/accounts` needs proof-of-work or Turnstile; 5 per IP an hour, 3 per email a day
Magic-link abuse	Single-use, 15 min, hashed at rest; the same answer whether or not the email exists
Stolen secret key	Rotate in HQ (old key lives 24 h) or revoke now; keys are hashed at rest
Cross-tenant reads	Every query is scoped to a site you're a member of; data routes 403 until verified

Rate limits

Route	Limit
Login	3 per email per 15 min, 10 per IP an hour
Magic-link verify	20 per IP a minute; a token locks after 5 bad tries
Accounts	5 per IP an hour, 3 per email a day
Collect	60 per IP a minute, 10k per key a minute, 1k per keyless hostname a minute
Check	30 per IP a minute
Data routes	120 per session a minute
Install check	30 per IP a minute

Every limit returns 429 with Retry-After. IPs are hashed with a daily salt, never stored raw.

Trust and quarantine

Each beacon gets trust 0 to 1 from origin match, plausibility, IP reputation, proof-of-work and tickets. Below 0.4 it's stored as unverified traffic: visible in HQ, kept out of stats, priors, relabel and webhooks.

Proof of work

When a spike is detected the API publishes DA-PoW: v=1;d=<bits>;nonce=<n> (response header and edge hint). The SDK solves SHA-256 over sid|host|nonce|solution in a worker; a missing answer quarantines, never drops. Default difficulty: 0.

Attested tickets (optional)

Your edge adapter adds Server-Timing: da;desc="t=<ticket>", an HMAC derived from your secret key. The beacon echoes it; a valid ticket means high trust. See Declared cover for edge hints.