4.0.0

T-Pot Attack Map 4.0.0

CARTO now requires an API key for its raster basemaps, leaving every T-Pot with a watermarked map. 4.0.0 removes the dependency: the Attack Map runs fully offline on MapLibre GL JS with a local PMTiles vector basemap — zero third-party requests at runtime, no API key, no online fallback.

New

• Offline vector basemap (MapLibre GL JS 6.6.0 + PMTiles, ≈45 MB, world z0–6), served by the app itself; dark and light styles without any map download on theme switch.
• Activity shading — countries shaded by event volume, crossfading into a density heatmap when zooming in; selectable in the settings (Mixed / Countries only / Heatmap only / Off).
• World-fit start view — all continents visible on any screen size, re-fitting on resize until you touch the map.
• Demo mode for local development without Elasticsearch/Redis/Docker: python3 AttackMapServer.py --demo.
• Security hardening — WebSocket origin check, connection limits and slow-consumer isolation, loopback bind by default, security headers, loss-free deterministic Elasticsearch polling, bounded browser cache.
• Supply chain — every asset vendored with SRI/provenance lock; basemap pinned by SHA-256 to the immutable release basemap-20260901-z6; all dependencies exactly pinned.

Notes

• Requires a WebGL2-capable browser; without it the dashboard keeps working and the map area shows a notice.
• Leaflet, D3, jQuery and Luxon are gone; attacker circles are now zoom-scaled markers.
• Fetch the basemap with tools/fetch_basemap.sh (the T-Pot image does this at build time). Verify with tools/check_all.sh.