• New: ENV variable expansion. Docs
• Security: Updated dependencies to address potential security vulnerabilities.

• Security: Updated dependencies to address potential security vulnerabilities.
• Legal: Updated the EULA.

• Fix: Resolved issues with AWS RDS Proxy TLS CA certificates affecting MySQL, MSSQL, and Oracle.
• Security: Updated dependencies to address potential security vulnerabilities.

• Security: Updated dependencies to address potential security vulnerabilities.

• Improved: Security Group rules now support a custom response message. Docs
• Improved: Rate limits now support the headers and log parameters. Docs
• Improved: Added support for the secret parameter in POST /v1/verify/signature. Docs
• Security: Updated dependencies to address potential security vulnerabilities.

• Improvement: Added IPINFO_IO_MMDB_DOWNLOAD_HEADERS and MAXMIND_DOWNLOAD_HEADERS to support custom HTTP headers in download requests. Docs
• Security: Updated dependencies to address potential security vulnerabilities.

• New: Expanded database support with MySQL, MariaDB, Microsoft SQL Server, Oracle, and Turbolite. Docs
• New: Enhanced database snapshots and point-in-time recovery (PITR) with support across all database backends. Docs
• Security: Updated dependencies to address potential security vulnerabilities.

• Security: Resolved false-positive findings reported by AWS Inspector.
• Security: Updated dependencies to address potential security vulnerabilities.

• Fix: Resolved a CORS regression affecting Widget v2 by exposing the x-altcha-config header via Access-Control-Expose-Headers.

• New: Tracking of header entropy and User-Agent commonality. Docs
• New: User-Agent parser endpoint. Docs
• New: Added the USER_AGENT_HEADER_UNCOMMON classifier rule for device classification. Docs
• Improvement: Updated the default list of high-risk countries and introduced the HIGH_RISK_COUNTRIES environment variable and highRiskCountries Security Groups setting, allowing customization of the high-risk country list. Docs
• Fix: Fixed the rate limiter (key=*) parameter.
• Security: Updated dependencies to address potential security vulnerabilities.

Breaking changes:

• High-risk countries:
  • Removed BR, CN, IN, PK, US, and VN from the default list.
  • Deprecated HIGH_RISK_COUNTRIES_EXCLUDE; use HIGH_RISK_COUNTRIES instead to define the list of penalized countries.
• User-Agent parser:
  • Browser and OS identification normalized:
    • Mac OS → macOS
    • Chromium OS → Chrome OS
    • Chrome on mobile → Mobile Chrome
    • Firefox on mobile → Mobile Firefox
• Rate limiting:
  • GET /v1/challenge is no longer rate-limited when HIS is active and the endpoint returns an HIS submission URL.

• Fix: Updated API documentation for the POST /v1/verify response.
• Fix: Reloading Threat Sources after URL updates in cluster setup.
• Fix: Improved container start script support for non-root execution.
• Security: Updated dependencies to address potential vulnerabilities.

• New: Added support for the TLS_EXTRA_CA_CERTS environment variable for configuring a global TLS/SSL CA certificate. Docs
• New: Added AWS S3 Express support in the storage adapter.
• Improvement: General UI fixes and minor usability enhancements.
• Security: Updated dependencies to address potential vulnerabilities and improve stability.

• Fix: AWS RDS certificate bundle.

UPDATE RECOMMENDED due to important security enhancements and platform improvements.

Highlights:

• New: Added Monitor mode for Human Interaction Signature (HIS). Docs
• New: Added the CORS_ORIGINS environment variable for configuring allowed origins. Docs
• Fix: Resolved pagination issues in Request Logs bulk CSV export.
• Fix: Threat Sources now refresh data correctly after URL updates.
• Fix: Improved handling of PoW v2 and the maxComplexity setting within Security Groups.
• Improvement: Enhanced Code Challenge image resistance against OCR-based detection and extraction.
• Improvement: General UI fixes and minor usability enhancements.
• Security: Docker image now uses Wolfi by Chainguard as the base image, including additional hardening improvements.
• Legal: Updated the EULA.

Highlights:

• Fix: Resolved an issue with relative paths in challenge responses when BASE_URL contains a pathname.
• Fix: Fixed Azure OIDC login when using a custom BASE_URL.
• Docs: Updated response schema documentation for /v1/verify/signature.
• Improvement: Security Group origin restrictions now support non-standard schemes (e.g., non-HTTPS, for native apps).
• Improvement: Enhanced parsing of Flutter and React Native user-agent headers; added support for browser type App.
• Improvement: General UI fixes and minor enhancements.
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• Fix: Resolved an issue with Azure OIDC when using Tenant ID.
• Improvement: PoW v2 is now the default version for newly created Security Groups.
• Improvement: Minor UI fixes and general enhancements.
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• New: Introduced the Human Interaction Signature protection mechanism to help identify automated activity (PoW v2 only). Docs
• New: Threat Sources now support authorization and custom HTTP headers. Docs
• New: Added a simple configuration UI for PoW v2 in Security Groups.
• Improvement: LDAP now supports username override via parameter. Docs
• Improvement: Log fetching for the dashboard now uses a PostgreSQL cursor to improve performance.
• Improvement: Enhanced error handling for the SQLite-backed threat intelligence index.
• Security: Updated dependencies to address potential vulnerabilities.

Migration required:

ClickHouse users must migrate the database schema to new columns. Docs

Highlights:

• New: Introduced a new speech synthesizer that generates high-quality audio verification challenges in 45 languages. Docs
• Optimization: Reduced memory usage by optimizing the Threat Intelligence index and adding support for a SQLite-backed store for low-memory environments. Docs
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• New: Added UI management for downloaded files (cached files), such as lists and mmdb databases, accessible under Admin → Files.
• New: Support for LibSQL databases and the Bunny.net edge platform. Docs
• New: Added environment variables:
  • HTTP(S)_PROXY: enables native request proxying. Docs
  • APP_BASE_PATH: allows prefixing the admin application URL. Docs
  • SECURITY_TXT: replaces the contents of /.well-known/security.txt. Docs
  • API_DOCS_ENABLED: disables API documentation at /v1/docs. Docs
• Improvement: LOG_LEVEL=debug now logs HTTP(S) requests made by the server.
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• New: Support for PoW V2 and the new widget (Beta).
• Improvement: Challenges now include an id (matching the id in the verification data).
• Improvement: Cache duration for used challenges is now configurable via the CACHE_DURATION_USED_CHALLENGES environment variable.
• Improvement: Penalty time-to-live is now configurable using the PENALTY_TTL environment variable.
• Fix: IPStack - updated API URL to use HTTPS.
• Security: Updated dependencies to address potential vulnerabilities.

UPDATE RECOMMENDED due to important stability improvements.

Highlights:

• Stability: Resolved a memory leak affecting the Threat Intelligence List.
• Stability: Enhanced data validation and enforced configurable limits for disposable email and phishing lists. Docs
• Stability: Improved error handling for MaxMind and IpInfo databases.
• Improvement: Added support for TLS certificates and additional configuration options to the LDAP connector. Docs
• Improvement: Minor UI fixes and general enhancements.

Highlights:

• Improvement: Added CSV and JSON export support for individual request logs.
• Improvement: Request logs for failed verifications that return verified: false now include the failure reason in the log’s error field.
• Security: Strengthened input validation for the /v1/verify endpoint, reducing potential attack vectors from malformed payloads.
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• Fix: Resolved additional timezone and usability issues affecting dashboard charts.
• Fix: Addressed audio challenge compatibility issues in Safari 26 by adding Content-Length response header.
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• New: Export request logs to CSV.
• Fix: Corrected average latency reporting in the dashboard when using Postgres as the logs backend.
• Fix: Resolved calendar time picker issues when using timezones different from the server timezone.
• Security: Updated dependencies to address potential vulnerabilities.

Highlights:

• New: Added limits for Threat Intelligence sources to prevent misconfiguration and excessive resource usage. Docs
• Improvement: Introduced new environment variables to override container CPU and memory limits. Docs
• Improvement: Multiple UI fixes and usability improvements:
  • Added log filtering by API key name.
  • Account dropdown entries are now sorted alphabetically by name.
  • Fixed rate-limiting issues when switching between accounts.

UPDATE RECOMMENDED due to a vulnerability in altcha-lib. See the Security Advisory.

Highlights:

• New: Added support for Redis Cluster and Redis Sentinel deployments. Docs
• Security: Updated altcha-lib to v1.4.1, preventing possible replay attacks via salt splicing. Security Advisory.
• Security: Updated dependencies to address potential security vulnerabilities.
• Improvement: Added missing legacy time zones still in use for geo-detection.

Highlights:

• Improvement: Removed all telemetry data from the license “call home” request. Docs
• Improvement: Enhanced the classifier’s RANDOM_CHARS logic to recognize a wider range of random sequences.
• Fix: Resolved issues with Google OAuth refresh token handling.
• Security: Updated dependencies to address potential security vulnerabilities.

Highlights:

• New: Ability to disable certain features on accounts. Docs
• New: Ability to adjust the maximum PoW complexity. Docs
• Fix: Rate limiters configured on API keys are now scoped under their respective API key, avoiding shared limits between keys for identically configured rate limiters.
• Fix: Added missing timezones to the built-in list used for geo-location.
• Fix: UI fixes and improvements related to responsiveness.
• Security: Updated dependencies to address potential security vulnerabilities.

Highlights:

• Security: Updated dependencies to address minor security vulnerabilities.
• Fix: Minor UI fixes and improvements.

Highlights:

• New: Challenge API now supports custom parameters. Docs
• Improved: PostgreSQL TLS/SSL support — AWS RDS CA bundle is now built-in for easier setup. Docs
• Fix: ipinfo.io with MMDB can now be enabled only when using IPINFO_IO_MMDB_DOWNLOAD_URL that includes an authorization token. Docs
• Security: Updated dependencies to address minor security vulnerabilities.

Highlights:

• New: Phishing URL detection in the Classifier and Email Spam Filter. Docs
• New: Classifier now includes two new rules: URL_PHISHING and CONSECUTIVE_LINE_BREAKS. Docs
• New: Simple rules configuration UI for Security Groups now supports request origins.
• Improved: Security Group rules now support conditions based on request origin, including wildcard matching. Docs
• Improved: The verificationData property returned from POST /v1/verify now includes additional values such as the request origin and user's timezone. Docs
• Improved: Request logs now include error messages for non-OK status codes.
• Fix: REDIS_KEY_PREFIX environment variable was not being applied.
• Fix: Minor UI fixes and improvements.

Migration required:

ClickHouse users must migrate the database schema to include error. Docs

Highlights:

• New: Email Spam Filter for parsing and classifying EML files. Docs
• New: Request logs now include verificationId from POST /v1/verify.
• New: Prometheus metrics now include API verification metrics. Docs
• Improved: General stability and minor bug fixes across the application.

Migration required:

ClickHouse users must migrate the database schema to include verificationId. Docs

Highlights:

• Improvement: AI providers now allow request parameter override using AI_PROVIDER_REQUEST_OPTIONS. Docs
• Fix: X_FORWARDED_FOR_TRUSTED with IPv4 + IPv6 dual stack
• Fix: CSP styles error in Safari

Highlights:

• Fix: Apply a default container memory limit when one is not explicitly set.
• Fix: Minor UI fixes and improvements.

Highlights:

• New: OpenTelemetry support (Enterprise only). Docs
• New: Added LICENSE_JSON environment variable to disable license-server verification.
• Fix: Total system memory and CPUs now correctly report the container’s limits if set.

Highlights:

• Improvement: Cluster monitoring now includes database and Redis health checks.
• Fix: Various UI enhancements and fixes related to clustering and application configuration.

This release introduces improved and simplified clustering with PostgreSQL as the primary database. Clustering is now also available in the Professional plan.

Highlights:

• New: Support for PostgreSQL as the primary database engine, offering better performance and scalability. Docs
• New: Streamlined clustering configuration for easier setup and management. Docs
• Improved: General stability, minor bug fixes, and performance enhancements across the application.

Highlights:

• Improvement: Threat Intelligence reporting endpoint now returns actions and whether the limit has been reached.
• Improvement: Optimized loading of Threat Intelligence data, significantly improving application start time.
• Fix: Minor UI fixes and improvements.

Highlights:

• New: Threat Intelligence for automatic detection and blocking of malicious IPs.
• Fix: Minor UI fixes and improvements.

Migration required:

If you previously used FIREHOL_* environment variables, review and update your configuration in the new Threat Sources section. These variables have been removed, and blocklist URLs are now managed directly through Threat Sources.

Highlights:

• New: Cloudflare IP resolver using the CF-IPCountry HTTP header.
• Improvement: Filtering and search capabilities across the application.
• Improvement: IP resolvers can be combined for more comprehensive IP resolution.
• Improvement: Alerts now include the API key and user-agent.
• Fix: Issue with the disableRules parameter in the classifier.
• Fix: Minor UI fixes and improvements.

Highlights:

• New Feature: ClickHouse integration for high-performance data storage and real-time analytics.
• Improvement: Enhanced analytics dashboard now displays the total number of requests and all matched spam rules.
• Improvement: More accurate language detection for very short texts.
• Improvement: Minor UI enhancements, including dark mode adjustments and general bug fixes.
• Fix: Issue with excluding countries from the high-risk country list.

Highlights:

• New: Added environment variables to configure update schedules for data sources and IP resolvers.
• Improvement: Updated Content Security Policy to support the redirect page and API documentation.
• Fix: Geo-location data was not being properly recorded in request logs.

Highlights:

• New Feature: IPInfo.io IP resolver – Integrated IPInfo.io service for IP resolution.
• Fix: Monitoring endpoints IP whitelist with default values causing issues with Kubernetes probes.

Highlights:

• New Feature: AI Security Rules.
• Fix: Improved WAV bit depth in audio challenges for better browser compatibility.
• Fix: Corrected CSP policy in JSON editor to restore style loading.
• Fix: Enhanced protection against replay attacks in /v1/verify/signature.

Highlights:

• New Feature: Links and Redirects – Generate short, shareable links that show a verification challenge before redirecting to the final destination. Helps block bots and abuse before users reach protected URLs.
• New Feature: Partial Similarity Matching – Identify suspicious phrases within longer text using substring-based detection.
• Breaking Change: Request logs and alerts now require admin role access.
• UI Improvements: General design polish and usability enhancements.

We're excited to announce the first public release of ALTCHA Sentinel!

Getting Started:

To begin using ALTCHA Sentinel, follow our Installation Guide.