Changelog

Integration guidance now distinguishes review, unavailable and complete allow responses. IP lookup no longer requires an email or subscribes you to the newsletter, handles failed checks explicitly and protects CSV cells from spreadsheet formulas. Status and service objectives explain what the probes actually measure, including gaps and shared dependencies.

The 18-second homepage walkthrough is rendered at 2560 × 1600 with less compression in English, German and Estonian. The first-paint loader uses stable evidence rows, a slate-and-blue palette and one small activity indicator. Reduced motion stops that indicator; the film stays deferred until needed.

New accounts start in English; explicit console language choices are remembered per account. Overview and Integration have clearer empty states and setup steps. A Cloudflare Workers route guard includes downloadable source, configuration and tests; it requires your own route, secret and origin-access configuration.

Shared database-backed account-attempt limits and email-send budgets strengthen abuse controls. Advertising measurement was removed; Google sign-in is separate and unchanged. Privacy, cookies and sub-processor notices describe current storage, while backup expiry and restore-erasure assurance remain explicitly open verification items.

The navigation pill frosts once the page scrolls under it, a ticker under the hero lists the VPNs, proxies, cloud hosts, fake browsers and bot tools the verdict sees through, dividers draw in as you reach them, the layer cards light up under the pointer and as they pass the centre of the screen, the code window has a Copy button, and the scanner’s loading skeleton dissolves into the result instead of crossfading through it. Nothing on the page is set under 11px any more, and the scanner speaks German and Estonian on /de and /et.

Sign up, make no API call in your first hour, and one short email arrives: the silence is normal, the curl on the Integration tab already carries your key, reply if unsure. Sent once per account and never again from that template, never with a live key in the mail.

The homepage, pricing, contact and the API reference render in English, German and Estonian at /de and /et; the blog and resources pages carry translated chrome around English articles; and the console — dashboard, settings, security, members — translates itself the moment you switch language. The EN / DE / ET switcher remembers your choice everywhere.

Hospitals, public health, government, election offices, emergency services, universities and the non-profits that fight abuse get the full API with the hourly limit removed. Free, no expiry, no strings beyond an acceptable-use line. Apply at /public-interest; institutional email domains are fast-tracked, and if you are under attack right now the cap comes off your existing key first. Two new guides on the blog: the program itself, and protecting sign-in and checkout endpoints against account takeover.

A chat pill on every page. Nothing from the chat provider is fetched until you click it, so no chat-provider request is made before that interaction; if a content blocker stops it, the pill says so and points to email instead.

One centred card and one stylesheet for all three, Google first, no checkboxes — continuing accepts the service terms, not optional marketing or device-storage consent — the email field focused for you, and a six-cell code box that submits itself when the last digit lands. The buttons no longer follow the cursor.

Public/sitemap.xml is built from the page and blog models: no duplicate URLs, no redirected posts, honest lastmod. Claims removed in August that had crept back through generators — a signal count, a provider attribution, “paid plans”, detection percentages — are gone again at the source, and the seven /stop pages describe their worked models as illustrative instead of headlining invented customer figures.

/pricing started its hero invisible and revealed it on scroll, so the largest text painted three times later than the page. The reveal animations now leave on-screen elements alone, navigation is not delayed for a fade, and the body font is preloaded everywhere.

Every post is generated from one content model with build-time cover art, seven pillar guides were rewritten from live lab evidence, thirteen low-value posts were cut behind 301s, and the dating-app fake-profile playbook — the most visited blog URL of the summer, as a 404 — is back as a real post.

“Email me a sign-in link” joins Google and GitHub on the sign-in page where it is offered. Auth0 verifies the address; Maskbreak issues its own session, with the same 2FA and suspension checks as every other route. Disclosed on the sub-processor list.

The admin panel became a console sibling: an overview, per-user drawer, delivery and health views, and real support levers — rotate a key with a 24-hour grace period, force logout, disable 2FA, resend the welcome email, delete with typed confirmation.

Events API failures, transactional-email delivery problems and user-facing error spikes each raise an alert instead of waiting to be noticed.

The hero now reads “Fraud hides behind a VPN. We see through it.” and explains in plain words what your site sends and what comes back: allow, review or block. Under it, a coverage strip shows the anonymity intelligence every verdict is scored against — 59,162,169 anonymous internet addresses, 543 known VPN services, 202 known proxy services, and the live cloud-range index — served by /api/threat-feed as coverage.ip_intel so the figures can be checked. The comparison table gains a “VPN & proxy detection, service named” row. Every claim that Maskbreak names the VPN or proxy now says “when known”, and a VPN on its own is documented as review, not block. The console, pricing, signup and product pages share one vocabulary: fake browser, cloud server, visitor checks.

Nothing on the four console pages renders under 12px any more; body text, table cells and labels are 13px, and the only secondary grey passes AA contrast. Alerts — webhook URL, Send test, signing secret, delivery log — are a card on the Integration tab instead of a drawer. Every event row carries a one-line “why” built from its signals, and Events is the landing tab. On phones the header is logo + Log Out with a four-link strip under it, and the Events table shows Time, IP and Decision without a sideways swipe.

The homepage’s seven stacked inline style layers and four page-only sheets are now a single file, home-2026.css. The lime accent is retired site-wide for ultramarine — marketing pages, auth pages, console, favicon, blog cover art — and every page shares the same header: ink mark, blue call to action. Type moved to Schibsted Grotesk and JetBrains Mono on 26 August; both are self-hosted.

The remake dropped <meta charset> and <meta name="viewport">, so real phones laid the homepage out at 980px and zoomed to 0.4. Both are back, and a build check now fails if any page loses them. The comparison table fits a 390px screen, and six blog URLs deleted in June — one of them the most-visited blog address of the quarter — now 301 to their successors instead of answering 404.

The site said “under 40ms server-side” in 405 places. Our own telemetry showed a median of 125 ms and a p95 of 371 ms — roughly one request in a thousand met the number. Every figure now states what is measured: under 150 ms, with the live numbers on /status. The latency objective on the SLA page was corrected in the same pass.

Alternatives pages for Cloudflare Turnstile, HUMAN, Signifyd and Friendly Captcha. The 30 per-country VPN pages and 9 per-provider hosting pages, which measured 71–90% identical to each other, are now anchored sections on /vpn-detection and /hosting; the old URLs redirect there.

sentinelsup/sdk 0.1.2 is on Packagist. The authenticated lookup endpoint now sends Cache-Control: no-store explicitly instead of relying on a CDN default to keep private results out of shared caches.

The published SDKs default to maskbreak.com. The MCP server reports its real name and version (binary maskbreak-mcp; sentinel-mcp stays as an alias). The OpenAPI spec documented webhook headers the server never sent — X-Sentinel-*, where the real ones are X-Maskbreak-Signature, X-Maskbreak-Timestamp and X-Maskbreak-Event-Id — and omitted OAuth entirely. Both corrected; the docs page already had the right names.

Every tile and every row used to carry the same visual weight, which made "is anything wrong right now" a reading exercise rather than a glance. Threats Detected and Threat Rate now sit on a tinted surface, and each event row carries a coloured rail — red for blocked, amber for review — so you can find them by scanning. The numerals deliberately stay in ink: colouring them red inverted the page's scan order when we tried it. Also: a sticky table header, tighter rows, and a visible focus ring on every input.

Our device-intelligence provider account was migrated, and between 2 and 5 August the device layer returned no signals — browserTampering, botDetected, emulator, virtualMachine and incognito were absent from /v1/evaluate responses during that window. Network-layer signals (VPN, proxy, Tor, datacenter) and decisions were unaffected throughout. The device layer is verified working again end to end, and the pipeline now runs against the provider's US region. If you gate on device signals specifically, evaluations from that window are worth re-checking.

We trialled Dreamdata, a business-to-business marketing attribution tool, on our public marketing pages. It was live for roughly 30 minutes before we removed it. In that window its account-level component sent page URL, title, canonical URL, referrer and the requesting IP to Dreamdata, used to estimate which organisation a visit came from. Its visitor-level component was gated behind analytics consent that this site does not grant — except for visitors whose browser blocks Google Tag Manager, for whom the gate is invisible and the visitor-level component, including form tracking, would have started normally. It never ran on the console or any signed-in page and received no customer API or evaluation data. It is fully removed: no code, endpoint or CSP entry remains. Also recorded in our dated sub-processor change log.

New structure rather than a repaint: the claim now stands alone with the live scanner rising into place below it, the three detection layers move past a sticky progress rail, and the integration section became a real code window with a language switcher covering Node, Python, PHP and cURL. Eleven elements that had been shipping permanently invisible — content in the DOM whose reveal animation never fired — are now visible.

You can now exchange your account email and API key for a short-lived bearer token at POST /oauth/token using the standard client_credentials grant, and use that token anywhere an API key is accepted. The token carries your account id, never the key itself, so rotating a key immediately invalidates every outstanding token. Discovery metadata is published at /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource. API keys keep working exactly as before — this is additive.

Any marketing or documentation page will return a clean markdown rendering when a client actually prefers it, so an LLM or agent reading the site gets prose instead of a wall of markup. Negotiated responses are never cached, so browsers always receive HTML.

Machine-readable entry points for AI agents evaluating Maskbreak: an RFC 9727 API catalog at /.well-known/api-catalog, an MCP server card, an agent skills index, WebMCP tool declarations on the docs, RFC 8288 Link headers pointing at all of it, and Content Signals in robots.txt stating plainly that this site may be read, cited and used as grounding.

The assistant widget's container carried aria-hidden while holding a real, focusable close button, so keyboard users could tab to a control no screen reader would read out. The attribute now sits on the decorative bubble only.

A full audit pass across the console, docs, and auth flow. The API reference at /api is reachable again (a routing regression had it redirect-looping). The dashboard now surfaces real error text instead of failing silently (playground, IP-lookup tool, CSV export, rules tab), quota 429s send a real Retry-After, the docs’ copy-paste examples were fixed end-to-end, invite and OTP flows gained honest recovery paths, and the mobile keyboard finally lets you type an IP in the lookup field.

Historical release: the Google Ads tag returned in storage-denied mode. It was removed on 6 September 2026. Storage-denied pings did not establish a blanket exemption from consent requirements; the current Cookie Policy supersedes this old description.

New GET /v1/usage returns the calling key’s quota position — key_type, hourly_limit, used_this_hour, remaining, resets_at, plus lifetime total_evaluations and limit_hits. It works for both live and test keys (each reports its own bucket) and the call itself is free — it never consumes quota; the in-window counters are advisory (in-memory, per-process, reset on deploy). Webhook payloads now carry a unique event_id (32-hex, test events included, echoed in an X-Maskbreak-Event-Id header on every delivery), and failed deliveries are retried: up to 3 attempts per event at roughly 1 and 8 minutes, best-effort in-process, with the same event_id on every attempt — so receivers dedupe on event_id instead of guessing from timestamps, and the Events log stays the source of truth. Also today: rules can be backtested in the dashboard — see how a rule would have decided your recent traffic before saving it — the status page’s per-service breakdown gained uptime history, and the antidetect detection guides were rewritten from scratch.

Threat-alert webhooks now keep a rolling 30-day delivery log — event type, HTTP outcome, and any error string, never payloads and never end-user IPs — in the dashboard's Tools drawer, so a silently failing endpoint is diagnosable at a glance. False-positive reports gained a status loop: each report is tracked open → resolved or dismissed, readable back via GET /api/fp-reports, so filing one is no longer a black hole. New GET /api/device-accounts lists devices seen across multiple of your accounts (account count, first/last seen) for multi-account investigation — per-customer and hash-only, as always. Settings adds email preferences (product notes and the monthly usage digest are individually switchable; security notices stay on) and org invite history; the Security page shows the sign-in browser history behind new-browser alerts. The status page's 90-day uptime bar now breaks down per service, /v1/evaluate adds device.first_seen (additive) so a brand-new device is distinguishable from a returning one, and the OpenAPI spec lands at 1.3.0 with the signed-webhooks delivery contract documented as a first-class webhooks section.

The Events view now lives in the URL: filters (range, decision, signal, threats-only, search, visitor) are encoded in the hash as you work, so a refresh keeps your place and the address bar is always a handoff-ready link. Every event's detail panel gains a copy-link button — the link opens that exact event, drawer and all, for any member of your org (backed by an additive ?id= on /api/lookups, still strictly account-scoped). Changing any filter returns you to the full log.

The Events tab gained an at-a-glance stat strip, decision and signal filters (?decision= / ?signal= on /api/lookups and the CSV export, additive), a one-click Export button, keyboard navigation (rows open with Enter, ↑/↓ steps through events in the detail panel), and honest failure states — a failed load now shows a retry instead of an eternal “Loading…”, and a failed Rules load disables Save so it can never wipe your policy with defaults. Every keyed API response now carries X-RateLimit-Limit / -Remaining / -Reset so you can back off before a 429, plus an X-Request-Id to quote to support. The docs page finally documents GET /v1/lookup/{ip}, the per-account test key, the hosted MCP server, and the exact webhook payload.

Alongside signal rules you can now pin a specific IP address or visitor: an explicit “always allow 203.0.113.7” beats a generic “VPN → block.” Pins are managed in the Rules tab or straight from any event's detail panel, apply to /v1/evaluate and /v1/lookup, and report themselves additively — decision_source: "exception" with the matched pins in a new exception_matched field, the engine's own verdict preserved in engine_decision, and webhook deliveries labeled Customer exception (…). Test tokens obey pins too, so one cURL verifies a pin before it ever touches live traffic.

Every account now has its own sk_test_… key (Settings → API Key). Unlike the public sandbox it runs the complete live pipeline — real tokens, device intelligence, your rules and pins included — but events are badged as test in the console, excluded from usage and stats, and never fire webhooks or limit emails. Responses carry "test": true, the key has its own hourly bucket, and it rotates without a password. Safe for CI and staging by construction.

Restrict live-key calls to your own server addresses (exact IPv4/IPv6 or IPv4 CIDR, canonicalized on save): anything else gets a 403 that names the calling IP in its hint. Enforced on /v1/evaluate, /v1/lookup, and the hosted MCP endpoint; the test key and the console are deliberately exempt, and every allowlist change emails a security notice. Configure it in Settings → API Key Security.

Every event's detail panel now has a “Report false positive” button — one click files the event's full context with our team (deduped per event) so wrong verdicts feed detection tuning instead of a support back-and-forth. Reported IPs follow the same 7-day hashing schedule as evaluation logs, and reports are deleted with your account.

Onboarding emails now carry a real unsubscribe link (RFC 8058 one-click for mail clients, a confirm page for humans — and the link no longer trips corporate mail-scanner prefetch). Suppression is honored at the recipient query, not at send time. New: a monthly summary of your own account's traffic — evaluations, threats, and the signal breakdown — sent only to accounts with real activity, with the same unsubscribe. Security and billing notices remain transactional and unaffected.

Sign in with a passkey (WebAuthn) instead of a password — enrol from the Security page, with re-authentication required to add one and a security notice on every add or removal. Passkey sign-in gets its own rate bucket so it can never lock out password login.

The whole point of Maskbreak is device and network intelligence — but the old client SDK captured only the network token, leaving device signals as a separate manual integration. The new sentinel.js loads both layers from a single <script> and injects both tokens (monocle for network, sentinel_fp for device) into your forms. Call Sentinel.collect() to get { token, fingerprintEventId } and forward both to /v1/evaluate — the endpoint accepts sentinel_fp as an alias, so device+network is now the default integration, not an opt-in. The quickstart, SDK READMEs, and AI-agent guide were all reframed around it; the dashboard’s “Test your browser” now exercises both layers. If a hardened browser blocks the device layer, evaluation continues network-only.

A new Rules tab lets you decide what each signal does: set VPN to Review, antidetect browsers to Block, disposable email to Allow — whatever fits your risk appetite. The decision field then returns your action (most-severe rule wins when several match), and your backend routes on it. The engine's own risk verdict is preserved in the additive engine_decision field, with decision_source and rule_matched alongside. Test tokens obey your rules too, so curl … test_vpn verifies a rule before you ship it. Also new: a “Test your browser” button in Events runs a real evaluation of your own connection through the live pipeline and streams the result into the log; the event detail panel gained a self-hosted world map (no third-party map tiles) marking the request's country; and the Overview chart-render bug from the Events-first change is fixed — it no longer blows up when the tab is opened from a background state.

The console now lands on the Events log: new events stream in automatically every 20 seconds (with a Live indicator, manual refresh, and a highlight on arrivals — no page reloads), visitor IDs are clickable to filter to that visitor, and the detail panel gains a “Back to events” control. The Overview was rebuilt around it: the daily chart now has a fixed height with rounded bars (it previously stretched to match the signal column and dwarfed low-volume accounts), signal composition sits in a compact three-column band — Outcome, Network, and Device side by side — and the old Recent Activity table is gone in favor of the full event log.

New Events tab in the console: every evaluation your key ran as a row — time, pseudonymous visitor ID, IP + country, browser/OS, signal chips, and the allow/review/block decision — filterable by range, threats-only, IP or visitor search. Click any row for the full picture: visitor history (events, threats, first/last seen, one-click filter to that visitor), the network verdict with service name, the device layer, and a copyable event record. Evaluation rows now persist a coarse browser/OS label, network service, risk score, decision, and a one-way-hashed visitor key (raw device identifiers are still never stored — privacy policy §1 updated). Events without a device layer say exactly how to enable it. The overview's daily chart is also capped at a sane height and the breakdown explains itself when the fingerprint layer hasn't fired yet.

The overview now shows the full signal taxonomy — network (VPN, proxy, datacenter, anonymous) and device (bot/automation, antidetect/tampering, incognito, disposable email) — with 30-day windows and vs-prior-period deltas, plus a fourth Device Flags stat tile. New sections: Geo Intelligence (top countries with per-country threat counts; country is kept as an aggregate while raw IPs still hash out at 7 days), Time of Day (weekday×hour heatmap and hourly clean-vs-threat composition, UTC), and auto-computed insight cards that stay hidden until your sample is large enough to be statistically honest. The API & Integration tab gains a Test & Ship section: the sk_test_sandbox CI recipe, deterministic test tokens, and the official Node/Python SDK installs. Powered by additive aggregates on /api/dashboard-init — nothing about existing fields changed.

Pricing now shows a concrete middle tier: Growth at €49/month (5,000 req/hr, priority support) — a founding price locked for everyone who signs up during beta, with billing starting only after 30 days' notice when beta ends, and overage always throttled (429) rather than billed. Developers get a public sk_test_sandbox key that answers the deterministic test_* tokens with documented shapes, no account needed — wired for CI. New content surfaces: six /stop playbooks (account takeover, fake signups, card testing, bonus abuse, trial abuse, multi-accounting), a glossary, and live-tracked hosting-provider range pages. Procurement can now self-serve the security whitepaper (PDF included) and the sub-processor list with a dated change log. The homepage gained an honest live-stats band fed by real production counts, and the API docs open with task-based entry points and a freshness stamp.

The traffic chart now draws real per-day columns with integer axis labels instead of a smoothed curve that invented shapes at low volume. Stat tiles suppress noisy week-over-week percentages on small samples, the plan card shows your actual hourly quota with a live this-hour meter, an Alerts chip reports whether your webhook is delivering (or failing), one-click Simulate buttons fire the new test tokens from the Playground, burner-email hits are tagged in Recent Activity, and an API-status chip answers "is it me or Maskbreak?" without leaving the console.

Deterministic test tokens (test_clean, test_vpn, test_proxy, test_datacenter, test_tor) exercise your allow/review/block handling from a terminal — never billed or stored. Pass an email to get email.disposable back from our 8,000-domain burner feed (adds the disposable_email reason and escalates allow to review). And 401/400 errors now carry hint + docs fields that name the actual mistake.

The homepage Live Risk Assessment now loads as a skeleton preview of the final panel — real row labels with shimmering placeholders exactly where each value lands — so results materialize in place instead of replacing a separate loading screen. The whole handoff is faster and steadier, and honors reduced-motion preferences.

Microsoft Clarity, Google Ads conversion tags, and the third-party blog embed no longer load on public pages. The Cookie and Privacy notices now match actual storage, profiling, retention, complaint, and transfer behaviour; Terms are explicitly business-only and align deletion timelines. The Ads tag returned on 19 July and was removed again on 6 September. See the latest privacy update above.

The IP Lookup tool gained single and bulk checks for public IPv4 and IPv6 addresses, with CSV export for up to 20 unique addresses. Coverage depends on the available network feeds and does not include browser evidence. Updated 6 Sep 2026: the original email gate and newsletter enrollment were removed; bulk checks now require no email.

The free IP Lookup tool now paints your connection identity (IP, country, browser) instantly and fills deep signals — VPN, proxy, datacenter, Tor, device intelligence — as the full verdict arrives. No more staring at a spinner while everything resolves at once.

Every page — homepage, console, docs, blog, case studies, all 95 public pages — converted from the dark editorial theme to a clean light shell with lime accents. New site-wide motion layer, unified pill navigation, an editorial blog reading experience, redesigned case studies with live counting metrics, and Senti, the scanner mascot that reacts to your verdict.

Four production-ready posts shipped to the blog. Card Testing Attacks covers the full bot operation — proxy routing, antidetect browsers, timing randomization, economics ($5–$50 per live card) — and shows exactly why Stripe Radar alone is insufficient. CAPTCHA Farm Economics documents the $0.0005–$0.002/solve market, how reCAPTCHA v3 gets gamed with warmed profiles, and why CAPTCHA is now only a deterrent against the least sophisticated bots. Loyalty Point Fraud maps dark-market valuations ($0.004–$0.012/mile), all four attack vectors, and a Python integration example. Bots at Product Launches breaks down waitlist hoarding, referral self-referral, SaaS trial stacking, and sneaker-drop scalping with real data. All posts include Article + FAQ + BreadcrumbList schema, newsletter capture, and related-article cross-links.

Two full case studies added. EU Sportsbook — iGaming Bonus Abuse: professional bonus hunters using Dolphin Anty + Bright Data residential proxies drained €87K in bonus credits before Maskbreak's antidetect detection and device clustering caught the pattern in 48 hours. European OTA — Travel Scalper Bots: Playwright-driven inventory-hoarding bots crashed checkout conversion to 34%; Maskbreak's headless artifact detection, ASN classification, and form-fill timing signals shut down the operation without adding CAPTCHA friction. Case-studies index updated with both cards; aggregate stats updated.

Shipped four long-form pieces targeting fresh high-intent keywords. Account Takeover Prevention: The 2026 Engineering Playbook covers session-cookie theft, real-time phishing kits, and device-bound sessions. iGaming Bonus Abuse Detection targets sportsbook/casino multi-account fraud with UKGC/MGA regulatory framing. Headless Browser Detection in 2026 documents what works after stealth plugins kill the classical signals. Detecting Agentic AI Browsers covers ChatGPT Atlas, Claude Computer Use, OpenAI Operator, and the policy decision every team needs to make about AI traffic. Each post ships with Article + FAQ + BreadcrumbList schema and inline links into the existing post graph.

Google OAuth tokens are now cryptographically verified with RS256 signatures against Google's JWKS public key endpoint on every auth request, pinning issuer, audience, and expiry.

Launched dedicated comparison pages for vs IPQS, vs SEON, vs Sift, vs Kount, and vs minFraud. Each page includes an objective feature matrix, pricing comparison, and Maskbreak's advantages.

Launched tailored landing pages for SaaS, Fintech, E-Commerce, and Gaming verticals. Each page addresses the specific fraud vectors and use cases relevant to that industry with targeted CTAs.

Launched /api/device-intel combining device smart signals with network intelligence. Returns a unified risk score with device-level and network-level signals in a single call.

Maskbreak entered public Open Beta. All features available for free with a limit of 10,000 API requests per month. No credit card required to sign up. Rate limits apply to prevent abuse. (The free tier has since been raised to 1,000 requests per hour.)