v1.40.0 — Experimental observations and WebRTC fix

Detection

• Remove the WebRTC local-address check (#89). Browsers hide local addresses by default, so it counted against ordinary visitors. The client no longer collects local IP addresses.
• Scoring responses include an experimental object with a versioned candidate score, wouldBlock, and experimental detections (#88). Monitoring is the default and changes no decision. Setting FCAPTCHA_EXPERIMENTAL_BLOCKING=stealth-corroboration-v1 opts into withholding tokens with reason experimental_detection; unknown or retired names, including true, stay monitoring-only. Opting in may reject visitors using developer tools or anti-fingerprinting tools. Do not use experimental results for access decisions unless you have opted in deliberately.
• The page/Worker hardwareConcurrency consistency check now runs on Go and Python as well as Node. It contributes to the score and does not count toward the corroboration floor.

Token format, admission limits, and baseline scoring are otherwise unchanged from 1.39.1.

Browser Subresource Integrity

{
  "version": "1.40.0",
  "fcaptcha.js": "sha384-dLx3ersPLE2v+Zj6OW4t8ixGNkUZMargWzNoNFP4D3X3SWuK4WYdzshzTTQN5m44",
  "dist/fcaptcha.min.js": "sha384-wPep/+aGbsDTZMGUg7oV92l1uLROHMDW96bUu36lLEHOxAgWJ3EL6WonyaK5LHBY"
}