Show HN: OpenTrust – Browser trust signals for the AI era

OpenTrust, an open-source SDK for privacy-preserving browser trust signals, has been released on GitHub. The tool detects browser automation, virtual cameras, and replay attacks while processing all data client-side, with raw frames never leaving the device. It provides confidence scores for fraud prevention and bot mitigation but is not a replacement for KYC or server-side verification.

Privacy-first browser trust signals for modern web applications. OpenTrust is an open-source SDK that collects privacy-preserving browser signals to help developers estimate the trustworthiness of a browser interaction. It provides signals — not decisions — designed to be combined with authentication, device reputation, and server-side verification systems. OpenTrust exposes browser-side trust signals through a clean TypeScript API: Browser automation detection — webdriver flags, headless browsers, abnormal properties Webcam integrity checks — virtual camera detection, static/replayed video analysis Passive liveness analysis — face presence, motion, blink detection Microphone integrity — virtual mic detection, audio signal analysis All processing is client-side. Raw frames never leave the device. OpenTrust is designed to provide additional signals for: - Fraud prevention workflows - Risk scoring and trust estimation - Bot mitigation systems - Browser integrity checks - Research and experimentation - Developer tooling and prototypes OpenTrust is not a replacement for: - KYC Know Your Customer - Identity verification - Enterprise liveness detection - Device attestation - Server-side fraud detection Security is built from multiple layers. OpenTrust intentionally focuses on browser-side trust signals and should be combined with server-side verification and authentication systems. The SDK returns confidence signals — not binary "human/bot" judgments. npm install opentrust-sdk js import { OpenTrust } from 'opentrust-sdk'; const result = await OpenTrust.verify { camera: true, } ; console.log result.trustScore ; // 0.85 console.log result.signals ; // { // faceDetected: true, // livenessScore: 0.72, // virtualCameraDetected: false, // browserAutomationDetected: false, // replayRisk: 0.12, // audioScore: 0.0, // virtualMicDetected: false // } | Option | Type | Default | Description | |---|---|---|---| camera | boolean | false | Enable webcam checks | microphone | boolean | false | Enable microphone checks | timeout | number | 15000 | Max time in ms | { trustScore: number, // 0.0 - 1.0 signals: { faceDetected: boolean, livenessScore: number, virtualCameraDetected: boolean, browserAutomationDetected: boolean, replayRisk: number, audioScore: number, virtualMicDetected: boolean, }, timestamp: number } npm install opentrust-react js import { useOpenTrust } from 'opentrust-react'; function VerificationButton { const { result, loading, verify } = useOpenTrust ; return <button onClick={ = verify { camera: true } } disabled={loading} {loading ? 'Analyzing...' : 'Collect Trust Signals'} </button ; } <script src="https://cdn.jsdelivr.net/npm/opentrust-sdk@0.1.0/dist-browser/opentrust.umd.js" </script <script const r = await OpenTrust.verify { camera: true } ; </script git clone https://github.com/rafaelEt/opentrust.git cd opentrust npm install npm run dev Or with Docker: docker compose up Visit http://localhost:3000 http://localhost:3000 . Or try the live demo: https://open--trust.vercel.app https://open--trust.vercel.app OpenTrust never uploads raw camera frames or microphone audio. All processing is client-side. See docs/privacy.md /rafaelEt/opentrust/blob/main/docs/privacy.md . MIT — see LICENSE /rafaelEt/opentrust/blob/main/LICENSE .