Changelog

Every tile and every row used to carry the same visual weight, which made "is anything wrong right now" a reading exercise rather than a glance. Threats Detected and Threat Rate now sit on a tinted surface, and each event row carries a coloured rail — red for blocked, amber for review — so you can find them by scanning. The numerals deliberately stay in ink: colouring them red inverted the page's scan order when we tried it. Also: a sticky table header, tighter rows, and a visible focus ring on every input.

Our device-intelligence provider account was migrated, and between 2 and 5 August the device layer returned no signals — browserTampering, botDetected, emulator, virtualMachine and incognito were absent from /v1/evaluate responses during that window. Network-layer signals (VPN, proxy, Tor, datacenter) and decisions were unaffected throughout. The device layer is verified working again end to end, and the pipeline now runs against the provider's US region. If you gate on device signals specifically, evaluations from that window are worth re-checking.

We trialled Dreamdata, a business-to-business marketing attribution tool, on our public marketing pages. It was live for roughly 30 minutes before we removed it. In that window its account-level component sent page URL, title, canonical URL, referrer and the requesting IP to Dreamdata, used to estimate which organisation a visit came from. Its visitor-level component was gated behind analytics consent that this site does not grant — except for visitors whose browser blocks Google Tag Manager, for whom the gate is invisible and the visitor-level component, including form tracking, would have started normally. It never ran on the console or any signed-in page and received no customer API or evaluation data. It is fully removed: no code, endpoint or CSP entry remains. Also recorded in our dated sub-processor change log.

New structure rather than a repaint: the claim now stands alone with the live scanner rising into place below it, the three detection layers move past a sticky progress rail, and the integration section became a real code window with a language switcher covering Node, Python, PHP and cURL. Eleven elements that had been shipping permanently invisible — content in the DOM whose reveal animation never fired — are now visible.

You can now exchange your account email and API key for a short-lived bearer token at POST /oauth/token using the standard client_credentials grant, and use that token anywhere an API key is accepted. The token carries your account id, never the key itself, so rotating a key immediately invalidates every outstanding token. Discovery metadata is published at /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource. API keys keep working exactly as before — this is additive.

Any marketing or documentation page will return a clean markdown rendering when a client actually prefers it, so an LLM or agent reading the site gets prose instead of a wall of markup. Negotiated responses are never cached, so browsers always receive HTML.

Machine-readable entry points for AI agents evaluating Maskbreak: an RFC 9727 API catalog at /.well-known/api-catalog, an MCP server card, an agent skills index, WebMCP tool declarations on the docs, RFC 8288 Link headers pointing at all of it, and Content Signals in robots.txt stating plainly that this site may be read, cited and used as grounding.

The assistant widget's container carried aria-hidden while holding a real, focusable close button, so keyboard users could tab to a control no screen reader would read out. The attribute now sits on the decorative bubble only.

A full audit pass across the console, docs, and auth flow. The API reference at /api is reachable again (a routing regression had it redirect-looping). The dashboard now surfaces real error text instead of failing silently (playground, IP-lookup tool, CSV export, rules tab), quota 429s send a real Retry-After, the docs’ copy-paste examples were fixed end-to-end, invite and OTP flows gained honest recovery paths, and the mobile keyboard finally lets you type an IP in the lookup field.

The Google Ads conversion tag is back on public marketing pages, in Consent Mode v2 with all storage permanently denied: no cookies, no consent UI, aggregated modeled conversions only. The Cookie Policy (§2.3) documents exactly what this does and does not collect.

New GET /v1/usage returns the calling key’s quota position — key_type, hourly_limit, used_this_hour, remaining, resets_at, plus lifetime total_evaluations and limit_hits. It works for both live and test keys (each reports its own bucket) and the call itself is free — it never consumes quota; the in-window counters are advisory (in-memory, per-process, reset on deploy). Webhook payloads now carry a unique event_id (32-hex, test events included, echoed in an X-Maskbreak-Event-Id header on every delivery), and failed deliveries are retried: up to 3 attempts per event at roughly 1 and 8 minutes, best-effort in-process, with the same event_id on every attempt — so receivers dedupe on event_id instead of guessing from timestamps, and the Events log stays the source of truth. Also today: rules can be backtested in the dashboard — see how a rule would have decided your recent traffic before saving it — the status page’s per-service breakdown gained uptime history, and the antidetect detection guides were rewritten from scratch.

Threat-alert webhooks now keep a rolling 30-day delivery log — event type, HTTP outcome, and any error string, never payloads and never end-user IPs — in the dashboard's Tools drawer, so a silently failing endpoint is diagnosable at a glance. False-positive reports gained a status loop: each report is tracked open → resolved or dismissed, readable back via GET /api/fp-reports, so filing one is no longer a black hole. New GET /api/device-accounts lists devices seen across multiple of your accounts (account count, first/last seen) for multi-account investigation — per-customer and hash-only, as always. Settings adds email preferences (product notes and the monthly usage digest are individually switchable; security notices stay on) and org invite history; the Security page shows the sign-in browser history behind new-browser alerts. The status page's 90-day uptime bar now breaks down per service, /v1/evaluate adds device.first_seen (additive) so a brand-new device is distinguishable from a returning one, and the OpenAPI spec lands at 1.3.0 with the signed-webhooks delivery contract documented as a first-class webhooks section.

The Events view now lives in the URL: filters (range, decision, signal, threats-only, search, visitor) are encoded in the hash as you work, so a refresh keeps your place and the address bar is always a handoff-ready link. Every event's detail panel gains a copy-link button — the link opens that exact event, drawer and all, for any member of your org (backed by an additive ?id= on /api/lookups, still strictly account-scoped). Changing any filter returns you to the full log.

The Events tab gained an at-a-glance stat strip, decision and signal filters (?decision= / ?signal= on /api/lookups and the CSV export, additive), a one-click Export button, keyboard navigation (rows open with Enter, ↑/↓ steps through events in the detail panel), and honest failure states — a failed load now shows a retry instead of an eternal “Loading…”, and a failed Rules load disables Save so it can never wipe your policy with defaults. Every keyed API response now carries X-RateLimit-Limit / -Remaining / -Reset so you can back off before a 429, plus an X-Request-Id to quote to support. The docs page finally documents GET /v1/lookup/{ip}, the per-account test key, the hosted MCP server, and the exact webhook payload.

Alongside signal rules you can now pin a specific IP address or visitor: an explicit “always allow 203.0.113.7” beats a generic “VPN → block.” Pins are managed in the Rules tab or straight from any event's detail panel, apply to /v1/evaluate and /v1/lookup, and report themselves additively — decision_source: "exception" with the matched pins in a new exception_matched field, the engine's own verdict preserved in engine_decision, and webhook deliveries labeled Customer exception (…). Test tokens obey pins too, so one cURL verifies a pin before it ever touches live traffic.

Every account now has its own sk_test_… key (Settings → API Key). Unlike the public sandbox it runs the complete live pipeline — real tokens, device intelligence, your rules and pins included — but events are badged as test in the console, excluded from usage and stats, and never fire webhooks or limit emails. Responses carry "test": true, the key has its own hourly bucket, and it rotates without a password. Safe for CI and staging by construction.

Restrict live-key calls to your own server addresses (exact IPv4/IPv6 or IPv4 CIDR, canonicalized on save): anything else gets a 403 that names the calling IP in its hint. Enforced on /v1/evaluate, /v1/lookup, and the hosted MCP endpoint; the test key and the console are deliberately exempt, and every allowlist change emails a security notice. Configure it in Settings → API Key Security.

Every event's detail panel now has a “Report false positive” button — one click files the event's full context with our team (deduped per event) so wrong verdicts feed detection tuning instead of a support back-and-forth. Reported IPs follow the same 7-day hashing schedule as evaluation logs, and reports are deleted with your account.

Onboarding emails now carry a real unsubscribe link (RFC 8058 one-click for mail clients, a confirm page for humans — and the link no longer trips corporate mail-scanner prefetch). Suppression is honored at the recipient query, not at send time. New: a monthly summary of your own account's traffic — evaluations, threats, and the signal breakdown — sent only to accounts with real activity, with the same unsubscribe. Security and billing notices remain transactional and unaffected.

Sign in with a passkey (WebAuthn) instead of a password — enrol from the Security page, with re-authentication required to add one and a security notice on every add or removal. Passkey sign-in gets its own rate bucket so it can never lock out password login.

The whole point of Maskbreak is device and network intelligence — but the old client SDK captured only the network token, leaving device signals as a separate manual integration. The new sentinel.js loads both layers from a single <script> and injects both tokens (monocle for network, sentinel_fp for device) into your forms. Call Sentinel.collect() to get { token, fingerprintEventId } and forward both to /v1/evaluate — the endpoint accepts sentinel_fp as an alias, so device+network is now the default integration, not an opt-in. The quickstart, SDK READMEs, and AI-agent guide were all reframed around it; the dashboard’s “Test your browser” now exercises both layers. If a hardened browser blocks the device layer, evaluation continues network-only.

A new Rules tab lets you decide what each signal does: set VPN to Review, antidetect browsers to Block, disposable email to Allow — whatever fits your risk appetite. The decision field then returns your action (most-severe rule wins when several match), and your backend routes on it. The engine's own risk verdict is preserved in the additive engine_decision field, with decision_source and rule_matched alongside. Test tokens obey your rules too, so curl … test_vpn verifies a rule before you ship it. Also new: a “Test your browser” button in Events runs a real evaluation of your own connection through the live pipeline and streams the result into the log; the event detail panel gained a self-hosted world map (no third-party map tiles) marking the request's country; and the Overview chart-render bug from the Events-first change is fixed — it no longer blows up when the tab is opened from a background state.

The console now lands on the Events log: new events stream in automatically every 20 seconds (with a Live indicator, manual refresh, and a highlight on arrivals — no page reloads), visitor IDs are clickable to filter to that visitor, and the detail panel gains a “Back to events” control. The Overview was rebuilt around it: the daily chart now has a fixed height with rounded bars (it previously stretched to match the signal column and dwarfed low-volume accounts), signal composition sits in a compact three-column band — Outcome, Network, and Device side by side — and the old Recent Activity table is gone in favor of the full event log.

New Events tab in the console: every evaluation your key ran as a row — time, pseudonymous visitor ID, IP + country, browser/OS, signal chips, and the allow/review/block decision — filterable by range, threats-only, IP or visitor search. Click any row for the full picture: visitor history (events, threats, first/last seen, one-click filter to that visitor), the Spur network verdict with service name, the Fingerprint device layer, and a copyable event record. Evaluation rows now persist a coarse browser/OS label, network service, risk score, decision, and a one-way-hashed visitor key (raw device identifiers are still never stored — privacy policy §1 updated). Events without a device layer say exactly how to enable it. The overview's daily chart is also capped at a sane height and the breakdown explains itself when the fingerprint layer hasn't fired yet.

The overview now shows the full signal taxonomy — network (VPN, proxy, datacenter, anonymous) and device (bot/automation, antidetect/tampering, incognito, disposable email) — with 30-day windows and vs-prior-period deltas, plus a fourth Device Flags stat tile. New sections: Geo Intelligence (top countries with per-country threat counts; country is kept as an aggregate while raw IPs still hash out at 7 days), Time of Day (weekday×hour heatmap and hourly clean-vs-threat composition, UTC), and auto-computed insight cards that stay hidden until your sample is large enough to be statistically honest. The API & Integration tab gains a Test & Ship section: the sk_test_sandbox CI recipe, deterministic test tokens, and the official Node/Python SDK installs. Powered by additive aggregates on /api/dashboard-init — nothing about existing fields changed.

Pricing now shows a concrete middle tier: Growth at €49/month (5,000 req/hr, priority support) — a founding price locked for everyone who signs up during beta, with billing starting only after 30 days' notice when beta ends, and overage always throttled (429) rather than billed. Developers get a public sk_test_sandbox key that answers the deterministic test_* tokens with documented shapes, no account needed — wired for CI. New content surfaces: six /stop playbooks (account takeover, fake signups, card testing, bonus abuse, trial abuse, multi-accounting), a glossary, and live-tracked hosting-provider range pages. Procurement can now self-serve the security whitepaper (PDF included) and the sub-processor list with a dated change log. The homepage gained an honest live-stats band fed by real production counts, and the API docs open with task-based entry points and a freshness stamp.

The traffic chart now draws real per-day columns with integer axis labels instead of a smoothed curve that invented shapes at low volume. Stat tiles suppress noisy week-over-week percentages on small samples, the plan card shows your actual hourly quota with a live this-hour meter, an Alerts chip reports whether your webhook is delivering (or failing), one-click Simulate buttons fire the new test tokens from the Playground, burner-email hits are tagged in Recent Activity, and an API-status chip answers "is it me or Maskbreak?" without leaving the console.

Deterministic test tokens (test_clean, test_vpn, test_proxy, test_datacenter, test_tor) exercise your allow/review/block handling from a terminal — never billed or stored. Pass an email to get email.disposable back from our 8,000-domain burner feed (adds the disposable_email reason and escalates allow to review). And 401/400 errors now carry hint + docs fields that name the actual mistake.

The homepage Live Risk Assessment now loads as a skeleton preview of the final panel — real row labels with shimmering placeholders exactly where each value lands — so results materialize in place instead of replacing a separate loading screen. The whole handoff is faster and steadier, and honors reduced-motion preferences.

Microsoft Clarity, Google Ads conversion tags, and the third-party blog embed no longer load on public pages. The Cookie and Privacy notices now match actual storage, profiling, retention, complaint, and transfer behaviour; Terms are explicitly business-only and align deletion timelines. The Ads tag returned 19 July in permanently consent-denied, cookieless mode — see the 19 July entry.

The IP Lookup tool now checks any public IPv4 or IPv6 address, not just your own connection: live allow/review/block verdict, risk score, VPN/proxy/Tor/datacenter/anonymity signals, and network attribution. The bulk tab checks up to 20 IPs at once with CSV export — free, work email required.

The free IP Lookup tool now paints your connection identity (IP, country, browser) instantly and fills deep signals — VPN, proxy, datacenter, Tor, device intelligence — as the full verdict arrives. No more staring at a spinner while everything resolves at once.

Every page — homepage, console, docs, blog, case studies, all 95 public pages — converted from the dark editorial theme to a clean light shell with lime accents. New site-wide motion layer, unified pill navigation, an editorial blog reading experience, redesigned case studies with live counting metrics, and Senti, the scanner mascot that reacts to your verdict.

Four production-ready posts shipped to the blog. Card Testing Attacks covers the full bot operation — proxy routing, antidetect browsers, timing randomization, economics ($5–$50 per live card) — and shows exactly why Stripe Radar alone is insufficient. CAPTCHA Farm Economics documents the $0.0005–$0.002/solve market, how reCAPTCHA v3 gets gamed with warmed profiles, and why CAPTCHA is now only a deterrent against the least sophisticated bots. Loyalty Point Fraud maps dark-market valuations ($0.004–$0.012/mile), all four attack vectors, and a Python integration example. Bots at Product Launches breaks down waitlist hoarding, referral self-referral, SaaS trial stacking, and sneaker-drop scalping with real data. All posts include Article + FAQ + BreadcrumbList schema, newsletter capture, and related-article cross-links.

Two full case studies added. EU Sportsbook — iGaming Bonus Abuse: professional bonus hunters using Dolphin Anty + Bright Data residential proxies drained €87K in bonus credits before Maskbreak's antidetect detection and device clustering caught the pattern in 48 hours. European OTA — Travel Scalper Bots: Playwright-driven inventory-hoarding bots crashed checkout conversion to 34%; Maskbreak's headless artifact detection, ASN classification, and form-fill timing signals shut down the operation without adding CAPTCHA friction. Case-studies index updated with both cards; aggregate stats updated.

Shipped four long-form pieces targeting fresh high-intent keywords. Account Takeover Prevention: The 2026 Engineering Playbook covers session-cookie theft, real-time phishing kits, and device-bound sessions. iGaming Bonus Abuse Detection targets sportsbook/casino multi-account fraud with UKGC/MGA regulatory framing. Headless Browser Detection in 2026 documents what works after stealth plugins kill the classical signals. Detecting Agentic AI Browsers covers ChatGPT Atlas, Claude Computer Use, OpenAI Operator, and the policy decision every team needs to make about AI traffic. Each post ships with Article + FAQ + BreadcrumbList schema and inline links into the existing post graph.

Google OAuth tokens are now cryptographically verified with RS256 signatures against Google's JWKS public key endpoint on every auth request, pinning issuer, audience, and expiry.

Launched dedicated comparison pages for vs IPQS, vs SEON, vs Sift, vs Kount, and vs minFraud. Each page includes an objective feature matrix, pricing comparison, and Maskbreak's advantages.

Launched tailored landing pages for SaaS, Fintech, E-Commerce, and Gaming verticals. Each page addresses the specific fraud vectors and use cases relevant to that industry with targeted CTAs.

Launched /api/device-intel combining device smart signals with network intelligence. Returns a unified risk score with device-level and network-level signals in a single call.

Maskbreak entered public Open Beta. All features available for free with a limit of 10,000 API requests per month. No credit card required to sign up. Rate limits apply to prevent abuse. (The free tier has since been raised to 1,000 requests per hour.)