GuardWork on every attempt
Proof of work is required, not optional. A caller that skips it is refused rather than quietly downgraded to a weaker result.
ABUSE DEFENCE
Guard sits in front of your signup, login and checkout. Every attempt costs the caller real work before your server ever sees it, and the token it produces can be spent once, on one action, from one of your own hostnames.
HOW IT WORKS
Your site key identifies the action being protected. A login is not a checkout, and they do not have to cost the same.
A proof of work runs before the form can be submitted. It is milliseconds for one visitor and a bill for somebody attempting thousands.
One call, and the token is spent. It cannot be replayed, and it cannot be moved to a different form.
WHAT IT DOES
Everything here is live, not planned.
Proof of work is required, not optional. A caller that skips it is refused rather than quietly downgraded to a weaker result.
A token authorises one action once. The second use is refused, so a captured token is worth nothing.
Bind a key to your hostnames and to the actions it may speak for. A key issued for your marketing page cannot mint proof for your checkout.
Repeated failures raise the cost, tracked per visitor and per address, so switching browser tabs does not reset the budget.
See what Guard saw: attempts, how many carried a proof, how many escalated, and what it scored, for your workspace only.
When a visitor says Guard got them wrong, that rescue is recorded, so a threshold can be judged against complaints rather than against nothing.
INTEGRATION
Install with npm i @bolrach/guard or pip install bolrach-guard.
<!-- on the page with the form -->
<script src="https://api.bolrach.io/v1/guard/sdk/guard.js"></script>
const guard = BolrachGuard.create({ key: 'YOUR_SITE_KEY' });
const result = await guard.protect('login');
// on your server, verifying SPENDS the token
const check = await guardApi.verifyToken({ token: result.token, action: 'login' });
if (!check.valid) reject(check.reason); // 'expired' vs 'replayed'HONEST LIMITS
Security products are usually sold on what they stop. It is more useful to know where the edges are.
A determined attacker with enough machine time can still pay the toll. The point is that mass abuse stops being cheap, and cheap is what most of it depends on.
Guard scores what it sees and shows you. What enforces today is the proof gate, nothing is refused because a score looked wrong.
An API client, a crawler or a callback never executes the script. Those should be authenticated by credential instead.
Create a site key, add one script, verify one token.