DEV Community: Mustafa Güngör

How We Audited and Hardened an Open-Source Anti-Bot Engine for Production (Synapse Shield v0.9.3)

Mustafa Güngör — Sun, 04 Oct 2026 06:40:02 +0000

Building a bot detection engine is challenging, but making it resilient against adversarial attacks, denial-of-service (DoS), and subtle concurrency bottlenecks in production is an entirely different battle.

A few days ago, we conducted an end-to-end security and algorithmic audit on Synapse Shield—our open-source, privacy-first alternative to commercial CAPTCHAs and proprietary cloud WAFs.

In this post, we'll walk through the actual architectural vulnerabilities we identified, how we patched them in v0.9.3, and what you can learn when designing high-throughput Python and Rust security middleware.

What is Synapse Shield?

Synapse Shield is a self-hosted, sub-millisecond bot mitigation engine. Instead of forcing legitimate users to click distorted fire hydrants or crosswalks, it analyzes behavioral biometrics (neuromuscular micro-tremors via jerk analysis, differential cursor curvature κ(t), and keystroke dynamics) along with network kinematics using a hybrid Python + Rust SIMD core.

However, security software must itself be impervious to abuse. Here are the vulnerabilities we audited, the real-world risks they posed, and how we resolved them.

1. Algorithmic DoS: The Poisson Factorial Bottleneck

The Problem

To detect abnormal request velocity (rate anomalies), we evaluate Poisson distribution probabilities for incoming IP request spikes. In earlier iterations, the cumulative probability was calculated using:

# Vulnerable code:
term = (math.pow(lambda_val, i) * math.exp(-lambda_val)) / math.factorial(i)

When an attacker flooded the endpoint with high request bursts (k >= 500), math.factorial(i) rapidly consumed excessive CPU cycles and raised an OverflowError. This opened up an Algorithmic Denial-of-Service (DoS / CPU Starvation) vector: an attacker could deliberately trigger extreme CPU exhaustion simply by generating large request counts.

The Fix

In v0.9.3, we replaced factorial computation with an O(1) iterative multiplicative recurrence. Furthermore, because Poisson cumulative probability approaches 1.0 when k >= 30 under standard baselines, we added a fast short-circuit cutoff:

# Hardened v0.9.3 implementation:
def poisson_anomaly_score(k: int, lambda_val: float = 2.0) -> float:
    if k <= 1:
        return 0.0
    if k >= 30:
        return 1.0  # Instant thresholding: avoids unnecessary math loops
    if lambda_val <= 0.0:
        return 0.0

    cumulative_prob = 0.0
    term = math.exp(-lambda_val)
    for i in range(k):
        if i > 0:
            term = term * lambda_val / i
        cumulative_prob += term

    return min(1.0, max(0.0, cumulative_prob))

Execution time dropped to < 0.1 ms, completely eliminating CPU starvation even under 100,000 incoming burst counts.

2. Keystroke Dynamics: O(N²) List Shifting

The Problem

During client-side keystroke hold-time analysis, timestamps for keydown and keyup events are paired. The previous implementation used a standard Python list:

# Vulnerable code:
down_t = pending_downs[k_code].pop(0)  # O(N) memory shift operation!

In Python, list.pop(0) shifts every subsequent element in memory to the left, making it an O(N) operation. When a user or scraper submitted long text inputs, the overall tokenization degraded to O(N²), blocking the asynchronous Event Loop.

The Fix

We switched the queue data structure to collections.deque:

from collections import defaultdict, deque

pending_downs = defaultdict(deque)
# ...
down_t = pending_downs[k_code].popleft()  # True O(1) popping

With popleft(), element extraction is now strictly O(1), ensuring zero event loop stalling even on massive typing payloads.

3. Reverse Proxy IP Spoofing & IPv4-Mapped IPv6 Masking

The Problem

In modern deployments, microservices sit behind Cloudflare, Nginx, or AWS ALBs. Blindly trusting X-Forwarded-For or X-Real-IP headers allows attackers to spoof their IP address.

Additionally, IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1) caused subnet masking routines to misclassify addresses or fail strict GDPR/KVKK anonymization policies.

The Fix

Dynamic Trusted Proxies: Added the SYNAPSE_TRUSTED_PROXIES environment variable configuration to restrict header traversal strictly to recognized proxies.
Proper IPv6 Normalization & Unwrapping:

def mask_ip(ip_str: str) -> str:
    """GDPR/KVKK compliance: Mask the last octet of IPv4 or last 4 blocks of IPv6."""
    try:
        ip = ipaddress.ip_address(ip_str)
        # Unwrap IPv4-mapped IPv6 addresses (e.g., ::ffff:10.0.0.1 -> 10.0.0.1)
        if getattr(ip, "ipv4_mapped", None):
            ip = ip.ipv4_mapped
        if ip.version == 4:
            network = ipaddress.ip_network(f"{ip}/24", strict=False)
            return f"{network.network_address.exploded.rsplit('.', 1)[0]}.*"
        else:
            network = ipaddress.ip_network(f"{ip}/64", strict=False)
            prefix = network.network_address.exploded.split(":")[:4]
            return f"{':'.join(prefix)}:*:*:*:*"
    except ValueError:
        return "unknown"

4. Preventing Arbitrary Code Execution on Model Loading & Path Traversal

The Problem

Synapse Shield uses pre-trained neural weights to evaluate client-side trajectory kinematics. Using numpy.load(weights_path) without restrictions can potentially allow arbitrary object unpickling (Arbitrary Code Execution / RCE) if a malicious file replaces the weights. Furthermore, the retrainer module lacked strict path validation.

The Fix

Enforced strict disallowed pickling and explicit canonical path validation:

# 1. RCE Guard (Pickling strictly disabled):
with np.load(weights_path, allow_pickle=False) as data:
    self.conv_w = np.array(data["conv_w"])

# 2. Path Traversal Guard (Canonical resolution & extension validation):
resolved = os.path.abspath(output_path)
if not resolved.endswith(".npz"):
    raise ValueError(f"Invalid output weights file extension: {output_path} (must be .npz)")

Benchmark Results (v0.9.3)

Following the audit, our test suite was updated to cover all targeted attack surfaces:

$ pytest tests -q
85 passed, 12 skipped in 6.74s (100% Success)

$ ruff check src tests
All checks passed!

Key performance metrics:

Overhead Latency: < 0.5 ms per incoming request (microsecond range).
Memory Footprint: Capped with O(1) LRU cache eviction.
Zero PII Exposure: Fully masked, GDPR/KVKK-compliant network telemetry.

Getting Started in 30 Seconds

You can integrate Synapse Shield into any FastAPI or ASGI application:

pip install synapse-shield

from fastapi import FastAPI
from synapse_shield import SynapseShieldMiddleware

app = FastAPI()

# Add Synapse Shield protection middleware
app.add_middleware(
    SynapseShieldMiddleware,
    protected_paths=["/api/v1/auth/login", "/api/v1/checkout"],
    action="block"  # Options: 'block', 'challenge', 'log'
)

@app.get("/")
async def root():
    return {"status": "protected"}

Open Source & Community

Security is not a static state; it is a continuous process of verification, testing, and refinement. We welcome feedback, code contributions, and security reviews from the community.

GitHub Repository: 0xStoic-bit/Synapse_Shield
PyPI: pypi.org/project/synapse-shield

If you find this project useful for protecting your endpoints against modern botnets, feel free to give the repository a star ⭐ and share your thoughts in the comments!

How I Rewrote Synapse Shield in Rust: Achieving Sub-Millisecond Kinematic Biometrics & 15 Multi-Platform Native Wheels with Maturin

Mustafa Güngör — Thu, 24 Sep 2026 19:38:42 +0000

When building an in-process Web Application Firewall (WAF) and bot mitigation system, your margin for latency error is practically zero.

Traditional CAPTCHAs degrade user experience, and cloud-based WAFs (like Cloudflare or AWS WAF) often inject 100ms to 250ms of network round-trip overhead. With Synapse Shield, my objective was clear: zero user friction (no puzzles, no clicks) and zero external network hops.

Everything had to happen inside the application process within microseconds.

In earlier versions (v0.6.x – v0.7.x), the core engine was written entirely in Python. While Python excels at rapid prototyping, orchestrating async web requests, and serving ML inference, it hit a brick wall when handling high-throughput kinematic feature extraction and concurrent state verification under botnet load.

Here is the technical deep-dive into how I re-engineered Synapse Shield’s core into Rust (synapse-core-rs), dropped feature extraction latency from 123 µs to 22 µs, replaced SQLite disk bottlenecks with an atomic two-bucket in-memory nonce cache, and automated the cross-compilation of 15 multi-platform native wheels using Maturin and GitHub Actions.

1. The Bottlenecks: Why Pure Python Reached Its Limit

To distinguish synthetic mouse and keyboard movements (generated by Puppeteer, Playwright, or Selenium) from biological humans, Synapse Shield extracts 24 kinematic and biometric features over time-series telemetry:

Third-order derivatives (Jerk: $d^3x/dt^3$): Detecting neuromuscular micro-tremors (8–12 Hz) that algorithmic bots either omit or fake with naive Gaussian jitter.
Fitts’ Law Terminal Deceleration: Biological motor control naturally decelerates in the final 25% of a ballistic trajectory as visual feedback guides the cursor to the target.
Euclidean Straightness & Curvature: Ratio of displacement to path length ($\frac{D}{\sum \Delta s}$).
Power Spectral Density & Spectral Entropy: Discrete Fast Fourier Transforms (RFFT) on velocity vectors.

       [ Client Telemetry (x, y, t) ]
                      │
                      ▼
   ┌─────────────────────────────────────┐
   │        Kinematic Differentiation    │
   │  Velocity (dx/dt) -> Accel -> Jerk  │
   ├─────────────────────────────────────┤
   │     Spectral Analysis (RFFT/PSD)    │
   ├─────────────────────────────────────┤
   │   Two-Bucket Nonce Replay Check     │
   └─────────────────────────────────────┘
                      │
                      ▼
             [ Bot / Human Score ]

The Problems Encountered:

GIL and Loop Overhead: Iterating over 150–300 trajectory points, calculating trigonometric arc distances, and running continuous numerical differentiations in Python loops incurred significant interpreter overhead.
Memory Allocation Churn: Dynamically allocating dozens of temporary lists per request under 5,000 req/s triggered aggressive Python garbage collection cycles.
SQLite Disk Locks under DDoS: To prevent replay attacks, nonces were originally written to an atomic SQLite table with WAL mode. Under concurrent spikes, SQLite file lock contention (sqlite3.OperationalError: database is locked) degraded throughput and increased p99 latency to over 15ms.

The solution was obvious: Extract the CPU-intensive numerical math and the high-concurrency state management into a compiled, memory-safe Rust extension.

2. Re-engineering Kinematics in Rust

In Rust (crates/synapse_core_rs/src/kinematics.rs), we process raw telemetry without heap allocations wherever possible, passing continuous slices and pre-allocating vectors with Vec::with_capacity.

Calculating Neuromuscular Jerk ($d^3x/dt^3$)

Synthetic curves (like Bézier or linear interpolation) look smooth to the naked eye, but in the 3rd derivative, their jerk profile collapses to zero or produces unnatural step functions.

Here is how we calculate discrete accelerations and absolute jerk:

// Accelerations & Jerk extraction in Rust
if velocities.len() >= 2 {
    let mut accelerations = Vec::with_capacity(velocities.len() - 1);
    for i in 1..velocities.len() {
        accelerations.push((velocities[i] - velocities[i - 1]) / dts[i]);
    }

    let acc_count = accelerations.len() as f64;
    let avg_acc: f64 = accelerations.iter().sum::<f64>() / acc_count;
    feat.avg_acceleration = avg_acc;
    feat.acceleration_var = accelerations.iter()
        .map(|&a| (a - avg_acc).powi(2))
        .sum::<f64>() / acc_count;

    if accelerations.len() >= 2 {
        let mut jerks = Vec::with_capacity(accelerations.len() - 1);
        for i in 1..accelerations.len() {
            jerks.push((accelerations[i] - accelerations[i - 1]) / dts[i + 1]);
        }

        if !jerks.is_empty() {
            let jerk_sum: f64 = jerks.iter().map(|&j| j.abs()).sum();
            feat.avg_jerk = jerk_sum / (jerks.len() as f64);
        }
    }
}

Discrete Spectral Analysis (RFFT) Without Heavy External BLAS

Rather than pulling in massive C-libraries (like FFTW) which complicate cross-compilation, we implemented a lightweight Discrete Real Fourier Transform optimized for small sequences ($N \le 300$ points):

pub fn compute_spectral_features(velocities: &[f64], avg_vel: f64, feat: &mut ExtractedFeatures) {
    let n = velocities.len();
    let num_freqs = n / 2 + 1;
    let mut psd = Vec::with_capacity(num_freqs);
    let v_centered: Vec<f64> = velocities.iter().map(|&v| v - avg_vel).collect();

    for k in 0..num_freqs {
        let mut re = 0.0;
        let mut im = 0.0;
        let angle_factor = 2.0 * std::f64::consts::PI * (k as f64) / (n as f64);
        for (t, &val) in v_centered.iter().enumerate() {
            let angle = angle_factor * (t as f64);
            re += val * angle.cos();
            im -= val * angle.sin();
        }
        let power = (re * re + im * im) / (n as f64);
        psd.push(power);
    }
    // Compute Spectral Purity & Spectral Entropy...
}

3. Sub-Microsecond Nonce Cache: The Two-Bucket Architecture

To prevent token replay attacks without touching the disk or invoking SQLite locks, we engineered a Two-Bucket In-Memory State Engine wrapped in an RwLock:

pub struct StateEngine {
    current_bucket: HashSet<String>,
    previous_bucket: HashSet<String>,
    last_rotation: Instant,
    window_duration: Duration,
    ip_bans: HashMap<String, u64>,
}

Why Two Buckets?

If you store nonces in a single hash set with individual TTLs, you must either run a background sweep thread (which causes locking pauses) or store timestamps with every entry (increasing memory overhead).

With Two Buckets:

Nonces are inserted into current_bucket.
When window_duration (e.g., 60 seconds) expires, previous_bucket is replaced with current_bucket via std::mem::replace, and a new, clean current_bucket is initialized.
Checking a nonce requires checking current_bucket.contains() or previous_bucket.contains().
Time Complexity: $O(1)$ lookups and $O(1)$ rotation, zero disk I/O, sub-microsecond latency ($< 0.8\ \mu s$).

pub fn consume_nonce(&mut self, nonce: &str) -> bool {
    self.maybe_rotate();

    // Check if seen in either active window
    if self.current_bucket.contains(nonce) || self.previous_bucket.contains(nonce) {
        return false; // Replay attack detected!
    }

    self.current_bucket.insert(nonce.to_string());
    true
}

4. Bridging Rust to Python via PyO3

Using PyO3, exposing our Rust engine to Python required zero boilerplate.

use pyo3::prelude::*;
use pyo3::types::{PyDict, PyAny};

#[pyfunction]
fn extract_features_rs<'py>(py: Python<'py>, telemetry: &Bound<'py, PyAny>) -> PyResult<Bound<'py, PyDict>> {
    let raw = parse_python_telemetry(telemetry);
    let feat = compute_kinematics(&raw);
    features_to_pydict(py, &feat)
}

#[pymodule]
fn synapse_core_rs(m: &Bound<'_, PyModule>) -> PyResult<()> {
    m.add_function(wrap_pyfunction!(is_rust_core_active, m)?)?;
    m.add_function(wrap_pyfunction!(extract_features_rs, m)?)?;
    m.add_function(wrap_pyfunction!(consume_nonce_rs, m)?)?;
    m.add_function(wrap_pyfunction!(is_ip_banned_rs, m)?)?;
    Ok(())
}

Seamless Python Fallback

In Python, we gracefully detect whether the native binary is present. If someone installs on an unsupported embedded architecture, it smoothly falls back to pure Python:

try:
    import synapse_core_rs as _core
    RUST_CORE_AVAILABLE = True
except ImportError:
    _core = None
    RUST_CORE_AVAILABLE = False

def extract_features(telemetry: dict) -> dict:
    if RUST_CORE_AVAILABLE:
        return _core.extract_features_rs(telemetry)
    return _python_fallback_extract_features(telemetry)

5. Shipping 15 Multi-Platform Native Wheels with Maturin

The biggest hurdle with compiled C/Rust extensions in Python is user distribution. If a user does pip install your-package and their machine triggers cargo build without a Rust toolchain installed, the installation fails.

We solved this by using Maturin paired with GitHub Actions matrix builds to generate pre-compiled binary wheels for:

Linux: manylinux_2_17 and musllinux_1_1 (x86_64, aarch64) across CPython 3.9, 3.10, 3.11, 3.12, and 3.13.
macOS: universal2 (supporting both Apple Silicon M-series and Intel x86_64).
Windows: MSVC x86_64.

The GitHub Actions Workflow Snippet:

name: Build Native Wheels
on:
  push:
    tags: ['v*']

jobs:
  build_wheels:
    name: Wheel on ${{ matrix.os }} (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
          - os: macos-latest
            target: universal2-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Build Wheels with Maturin
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist -m crates/synapse_core_rs/Cargo.toml
          manylinux: auto

When users run pip install synapse-shield, pip automatically pulls the pre-built .whl for their exact OS and Python ABI. Zero C++ compilers, zero Rust toolchains required on the client machine.

6. Benchmarks: 10,000-Request Stress Test

To validate the architecture, we ran an adversarial benchmark simulating a high-rate botnet assault (10,000 continuous requests across 50 worker threads).

Metric	Pure Python (v0.7.x)	Rust Core (`synapse-core-rs` v0.8.2)	Improvement
Feature Extraction Latency	`123.4 µs`	`21.8 µs`	~5.6x faster (82% reduction)
Replay Nonce Verification	`1,240.0 µs` (SQLite)	`0.7 µs` (Two-Bucket)	~1,700x faster
Max Throughput (RPS)	`2,450 req/s`	`11,200 req/s`	4.5x higher capacity
P99 Defense Latency	`18.2 ms`	`0.84 ms`	Sub-millisecond guaranteed
Dropped / Locked Requests	`0.42%` (SQLite lock)	`0.00%`	100% Reliability

Under saturated load, the pure Python version choked on SQLite locks and GIL context switching. The Rust native engine kept CPU utilization flat and processed all 10,000 requests without a single dropped packet.

Key Lessons for Systems Engineers

Don't rewrite everything—isolate the hot paths: Python is fantastic for FastAPI middleware, configuration parsing, and routing. Rust is unmatched for high-frequency differentiation, cryptographic hashing, and atomic concurrency. PyO3 gives you the best of both worlds.
Disk I/O has no place in microsecond security pipelines: Moving replay attack prevention from SQLite into an in-memory double-buffering scheme (Two-Bucket) provided the single largest latency win.
Maturin makes shipping Rust wheels delightful: Building cross-platform binary wheels used to require terrifying Docker setups. With maturin-action, distributing native extensions to PyPI is now as straightforward as publishing pure Python packages.

Links & Source Code

📦 PyPI: synapse-shield | synapse-core-rs
💻 GitHub Repository: 0xStoic-bit/Synapse_Shield
📝 License: MIT

If you are working on bot mitigation, biometric signal processing, or writing high-performance Python extensions in Rust, feel free to star the repo or leave your thoughts below!

Building a 19D Kinematic Biometrics Engine for Bot Mitigation in FastAPI

Mustafa Güngör — Tue, 15 Sep 2026 19:47:19 +0000

The Problem with Modern Bot Detection

Most web applications rely on standard rate-limiting (Leaky Bucket, Token Bucket) or invasive third-party CAPTCHA widgets.

However, modern automated scrapers and headless browser suites (Playwright, Selenium-Stealth, Undetected-Chromedriver) bypass IP-based rate limiters with cheap residential proxies. Meanwhile, forcing human users to click traffic lights or solve distorted puzzles degrades user experience and leaks privacy.

What if we could identify automation at the middleware layer using pure behavioral biometrics — without storing a single piece of Personally Identifiable Information (Zero-PII)?

Here is how I designed and built a 19-dimensional kinematic engine and cryptographic challenge protocol from scratch.

Architecture Overview: The 5 Defense Layers

Instead of treating incoming HTTP requests as isolated JSON payloads, the engine processes telemetry through a multi-tiered pipeline:

[ Incoming Request ]
         │
         ▼
[ Layer 1: Cryptographic Guard ]   ── HMAC-SHA256 Challenge & Single-Use Nonce
         │
         ▼
[ Layer 2: Anti-Stealth Scanner ]  ── Prototype Unhooking & Runtime Checks
         │
         ▼
[ Layer 3: 19D Kinematics Engine ] ── Jerk Analysis & Fitts's Law Profiling
         │
         ▼
[ Layer 4: Micro-Brain (1D-CNN) ]  ── 60-Step Sequence Pattern Detection
         │
         ▼
[ Layer 5: Network Anomaly Guard ] ── Sliding-Window Poisson & IP Quarantine

1. Kinematics: Why Bots Fail at Third-Order Derivatives

Most bot scripts simulate mouse movements using linear interpolation, Bézier curves, or basic Gaussian jitter. While a Bézier curve looks smooth to the naked eye, its physical properties immediately expose it.

Neuro-Muscular Tremor & Jerk Analysis

Human motor control is naturally imperfect due to neuromuscular lag. When a human moves a cursor:

Position: x(t)
Velocity: v(t) = dx/dt
Acceleration: a(t) = d²x/dt²
Jerk: j(t) = d³x/dt³

Automated scripts trying to minimize jerk (such as Flash & Hogan models) or applying naive random noise generate unnatural velocity spikes or mathematically flat jerk profiles.

In our telemetry extractor, we compute discrete third derivatives over microsecond-stamped coordinates:

import numpy as np

def calculate_jerk_profile(timestamps: np.ndarray, x: np.ndarray, y: np.ndarray):
    dt = np.diff(timestamps)
    # Prevent zero-division on microsecond clamping
    dt = np.where(dt <= 0, 1e-6, dt)

    # Velocities
    vx = np.diff(x) / dt
    vy = np.diff(y) / dt

    # Accelerations
    dt_mid = 0.5 * (dt[:-1] + dt[1:])
    ax = np.diff(vx) / dt_mid
    ay = np.diff(vy) / dt_mid
    a = np.hypot(ax, ay)

    # Jerk (Third derivative)
    dt_jerk = dt_mid[:-1]
    jerk = np.diff(a) / dt_jerk

    return float(np.var(jerk)), float(np.mean(np.abs(jerk)))

Terminal Deceleration (Fitts's Law)

When humans move a pointer to click a target, the final 20–25% of the trajectory exhibits progressive deceleration to stabilize target acquisition.

Bots typically maintain constant velocity until the exact click coordinate or snap abruptly. By calculating velocity ratios in the terminal phase, robotic trajectories are separated with high statistical confidence.

2. Zero-PII Cryptographic Defense

Client-side behavioral collectors are worthless if an attacker can simply capture a real human session and replay the payload.

To guarantee zero data storage while maintaining atomic replay resistance:

The server issues a timestamped, HMAC-SHA256 signed token containing a high-entropy random nonce.
The client telemetry payload is signed alongside this nonce.
The middleware verifies that elapsed time exceeds a physiological human threshold (t_elapsed > 1500 ms).
The nonce is consumed atomically via distributed cache (Redis SET key 1 EX 120 NX or local SQLite WAL transactions).
Any subsequent request reusing the same token is rejected with HTTP 403 instantly.

3. Fast In-Process Inference Without Bloat

A security middleware cannot afford 100ms inference latencies. Standard PyTorch or TensorFlow runtimes introduce heavy memory footprints and cold-start penalties.

Instead:

The 1D-CNN sequence classifier was trained offline on trajectory vectors.
Model weights were exported directly to compressed NumPy arrays (.npz).
The forward pass is executed in pure NumPy using vector operations, completing inference in under 2 milliseconds inside the ASGI event loop.

Key Takeaways

Physical laws beat statistical obfuscation: Advanced stealth tools can fake navigator.webdriver, but mimicking human neuromuscular jerk across time derivatives without massive latency overhead is computationally expensive for scrapers.
Stateless cryptography reduces attack surfaces: You don't need user cookies or session tables to verify authenticity.
Keep middleware lean: Pre-compiled arrays and pure matrix operations beat bloated ML runtime dependencies every single time.

What challenges have you faced when dealing with modern automated traffic? Let's discuss in the comments below!

I built an open-source alternative to Cloudflare Turnstile using Fitts's Law and Kinematics

Mustafa Güngör — Tue, 01 Sep 2026 12:23:05 +0000

Hey everyone! 👋

I’ve always hated intrusive CAPTCHAs and expensive proprietary cloud WAFs. Even the "invisible" ones (like Cloudflare Turnstile or reCAPTCHA v3) are black boxes that collect massive amounts of user telemetry.

So, I spent the last few months building Synapse Shield — a completely open-source, self-hosted behavioral bot mitigation engine for Python (FastAPI/Django/Flask) and React.

🔗 GitHub Repository: https://github.com/0xStoic-bit/Synapse_Shield
📦 PyPI Package: https://pypi.org/project/synapse-shield/

🧠 How it works (Kinematics & Math)

Instead of just checking if a mouse moves in a straight line, Synapse Shield analyzes 19D kinematic vectors in sub-milliseconds:

Jerk (3rd Derivative of Position): Human muscles have micro-tremors. Bots (even advanced Bézier curve bots) produce near-zero or static Jerk. The engine looks for biological tremors ($da/dt$).
Fitts's Law Terminal Deceleration: Humans naturally decelerate as the cursor approaches a target to click. We measure the terminal_decel_ratio to catch bots.
Poisson Anomaly Detection: Headless API flooders are caught using a cumulative Poisson distribution algorithm.

✨ Key Features & Hardening (v0.5.0)

⚡ Async Non-Blocking SLA (<0.5ms): Offloaded via asyncio.to_thread so it never blocks the FastAPI/Django event loop.
🔐 Cryptographic Replay Defense: Uses HMAC-SHA256 signed nonces (with SQLite WAL) to ensure tokens can't be replayed.
♿ Accessibility Mode: accessibility_mode=True gracefully scales down kinematic thresholds so motor-impaired users aren't falsely flagged.
⚛️ React & Next.js SSR Support: Native "use client" Drop-in Component and hook to avoid Hydration errors.
📈 Enterprise Prometheus Metrics: Native PROMETHEUS_MULTIPROC_DIR support for Gunicorn/Uvicorn workers.

🚀 Quick Code Example (FastAPI)


python
from fastapi import FastAPI, Request
from synapse_shield import shield_protect, SynapseShieldMiddleware

app = FastAPI()
app.add_middleware(SynapseShieldMiddleware, protected_paths=["/api/auth"])

@app.post("/api/login")
@shield_protect(max_risk_score=50.0, accessibility_mode=False)
async def login(request: Request):
    return {"status": "authenticated"}

I'm a 2nd-year Computer Engineering student, and I built this to bridge the gap between low-level math and modern web frameworks.

I’d love your feedback, code audits, or ideas on how to improve the kinematics engine!