Traditional CAPTCHAs hurt user conversion rates while increasingly failing to stop vision-LLM solvers and stealth browser automation frameworks (playwright-extra, nodriver, ghost-cursor).
Synapse Shield takes a different approach: zero-CAPTCHA, invisible behavioral biometrics powered by a native Rust (PyO3 + AVX2 SIMD) core and a pure-NumPy 1D-CNN Micro-Brain.
With the release of v0.9.8, the engine introduces major adversarial security hardening, Shadow Mode for zero-risk production rollouts, 1-line Frontend SDK interceptors, Zero-PII GDPR hashing, and Alpine Linux (musllinux) native binary wheels.
Here is a technical deep dive into how the 5-layer defense architecture works, the adversarial bypass vectors we patched during our internal red-team audit, and what is new in v0.9.8.
Instead of interrupting users with visual puzzles, Synapse Shield evaluates human neuro-mechanics invisibly in the background:
navigator.webdriver prototype overrides, mocked PluginArray instances, and Canvas/WebGL hooks via clean iframe Function.prototype.toString inspection.v0.9.8
When building an open-source security library, you must assume sophisticated attackers will read the source code to look for edge cases. For v0.9.8, we audited every layer of the engine from an adversarial perspective and closed several subtle evasion vectors:
Privacy-focused browsers like Brave intentionally farble WebGL and Canvas APIs (is_webgl_hooked = true). To prevent false positives for privacy-conscious users, the engine previously capped the risk score at 34.0 when basic trajectory straightness and jerk appeared organic.
"is_webgl_hooked": true into the browser telemetry object—camouflaging the bot as a privacy browser to force the score cap at 34.0. dt_var) 100% risk.
Previously, full kinematic curve heuristics only engaged when mouse_points > 5. A bot sending a 4-point ruler-straight line ( straightness = 1.0, jerk = 0.0) could slip between the "zero-mouse" rule and the 6-point kinematic analyzer.
The Time-Travel defense stops bots from stuffing 10 seconds of pre-recorded mouse telemetry into a 1.6-second challenge window (max(t) - min(t) > elapsed).
challenge_ts creation window so pre-recorded human trajectories from past sessions cannot be replayed.uvicorn --workers N) Write-Through Sync & Dwell-Time Parity
keydown/ keyup event pairing with the Rust/Python keystroke dynamics analyzer for sub-millisecond dwell-time variance and digraph entropy accuracy.mode="shadow") for Safe Production Rollouts
Engineering teams rarely want to enable hard blocking (HTTP 403) on Day 1 in production. You can now deploy Synapse Shield in Shadow Mode across FastAPI, Litestar, Sanic, Django, Flask, and pure ASGI:
from fastapi import FastAPI
from synapse_shield.asgi import SynapseShieldASGIMiddleware
app = FastAPI()
app.add_middleware(
SynapseShieldASGIMiddleware,
protected_paths=["/api/auth", "/checkout"],
max_risk_score=50.0,
mode="shadow", # Switch to "enforce" once validated
)
protectFetch & protectAxios)
You no longer need to manually embed tokens inside JSON request bodies. Passing the token via the X-Synapse-Token HTTP header eliminates schema conflicts with strict Pydantic (extra="forbid") models and allows seamless protection for multipart/form-data file uploads and URL-encoded forms:
// Automatically attaches X-Synapse-Token header to matching routes
await SynapseShield.init();
SynapseShield.protectFetch(["/api/auth", "/checkout"]);
// Or with Axios:
SynapseShield.protectAxios(axiosInstance, ["/api/auth", "/checkout"]);
SYNAPSE_PRIVACY_MODE=hash) & Auto-TTL Pruning
For strict GDPR/privacy compliance, setting SYNAPSE_PRIVACY_MODE=hash replaces client IP addresses with a daily-rotating salted HMAC-SHA256 digest (anon_8f3a...) before any data touches disk or logs. Additionally, automatic TTL retention (SYNAPSE_LOG_RETENTION_DAYS=14) prunes old telemetry records automatically.
musllinux) Native Wheels
pip install synapse-shield now only requires numpy. Server and dashboard dependencies ( fastapi, uvicorn, websockets) are isolated into optional extras ( pip install "synapse-shield[cockpit]"). py.typed and synapse_core_rs.pyi type stubs for full IDE autocompletion and mypy/ pyright checks across the Rust boundary.manylinux, Windows, and macOS (Intel & Apple Silicon) for Python 3.10 through 3.14—allowing FROM python:3.12-alpine containers to install the native binary in 1 second without a Rust toolchain.
pip install -U synapse-shield
pip install -U "synapse-shield[cockpit]"
synapse-shield start