capd@4.0.0

This is the biggest rewrite of Cap, ever. A rebuilt dashboard, per-request analytics, rules, lists, webhooks, and bot and AI agent detection on top of the proof of work.

Upgrading from 3.x needs a few manual steps. Site secrets, API keys and dashboard sessions from v3 have to be reset, and older compose files need a data volume. Migrating from v3 to v4

Analytics

Capd now uses ClickHouse or DuckDB to store every challenge, solve, block and rate limit event with its country, network, platform, browser, risk score and solve time.

Protection

Detect a wide range of bots and automation tools, and block them with a challenge or block. Capd can now detect scripted clicks, robotic movements and dozens of AI agents.

Breaking changes

• Secrets have been switched to SHA-256
• Analytics now use Clickhouse or DuckDB. Events need a volume at /usr/src/app/data. Per-country, per-network and per-platform history from v3 will be lost due to changes in how events are stored
• The env vars CORS_ORIGIN, RATELIMIT_IP_HEADER, ENABLE_ASSETS_SERVER, WIDGET_VERSION and WASM_VERSION are now dashboard settings.
• The env vars DEMO_MODE, RSW_BITS, SHOW_ERRORS, DISABLE_ERROR_LOGGING and HIDE_RATELIMIT_IP_WARNING have been removed.