Building a Local-First ATO Risk Scorer: Looking for Security-Minded Feedback

I've been working on a lightweight, zero-dependency middleware for Node.js aimed at solving a specific pain point. Zero-config entry points are now available for Express, Fastify, and Next.js Middleware — each with its own signal-coverage notes (full breakdown in the wiki).

Instead of relying on heavy, third-party fraud APIs that introduce latency and require sending sensitive user telemetry off-server, I've built a local, tunable rules engine to handle ATO (Account Takeover) and SIM-swap detection natively.

Try it:

npm install github:blacksanddesignsandbranding-dot/account-takeover-risk-scorer

Installs directly from the repo — no separate npm registry publish required.

Repo: https://github.com/blacksanddesignsandbranding-dot/account-takeover-risk-scorer

The Architecture:

• Zero-Latency: The logic runs entirely within the local request/response cycle.
• Privacy-First: All data stays within your private network.
• Fail-Open Design: Your authentication flow remains uninterrupted, even if the scorer encounters a logic exception.

Why I'm opening this up:

I've reached a point where I want to pressure-test the rules engine against real-world scenarios. I've just open-sourced the project under the DevGuard Labs banner and am currently looking for developers to help beta-test the logic.

How you can help:

If you're building auth-heavy applications, I'd love for you to take a look at the repo and see how the session-velocity checks are handled — currently a simple time-filtered count, not a true sliding-window structure. Feedback on whether that's worth upgrading is welcome.

I've also just added a local IP-reputation blocklist signal (CIDR-aware, zero external API calls, matching the rest of the package's philosophy) — feedback on the design in lib/ipReputation.js is especially welcome.

Any feedback — or even a Star if you find the approach useful for your own stack — would be greatly appreciated as I work on the next phase of the rules engine!

Comments

[DevGuard Labs]

Update (July 14): a few things have changed since I first posted this —

• Zero-config entry points now exist for all three frameworks (Express, Fastify, Next.js Middleware) — not just Express as originally noted
• Added a local IP-reputation signal (blocklist + CIDR matching, no external API calls, consistent with the rest of the package's zero-latency design)
• Docs/wiki updated to match — Architecture overview and Integration guide both cover the new signal and framework coverage

Repo's current as of this comment. Appreciate everyone who's looked at
it so far — still very much looking for edge cases and feedback on the
rules engine.