Fourteen layers

The layers

The name and its one line on the left; what it actually does on the right.

Venilator policy VM12 policies, 8 enforcing

A custom stack-based VM compiles the 12 hand-written .vnl policy files into bytecode and runs them deterministically on the requests each policy guards — sign-in, signup, invites, uploads, messages and the API surface. Eight can stop a request (block or throttle): account_security, anti_spam, content_filter, ddos_shield, file_upload, global, invite_abuse, login_guard. The other four watch and log.

Aegis behavioral engineAnti-DDoS and bot detection

Real-time per-IP and per-user metrics in Redis. Computes timing entropy on the last 50 requests — robotically perfect intervals score low, natural human pauses score high — and feeds the score back into the Venilator policies, so a bot is throttled by its rhythm, not only by its address.

Sentinel account-takeover defenseRisk scoring at sign-in

Device fingerprinting and credential-stuffing detection. Risk-scores every login — password, two-factor and OAuth: a new device adds 30, a country change within an hour of the last login adds 35, and five or more failed attempts in 15 minutes add 20. The score is recorded and logged today; it does not block on its own.

Cipher audit ledgerHash-chained, append-only

Append-only audit log where each entry's SHA-256 hash includes the previous entry's hash. Retroactive tampering breaks the chain at the modified entry. /cipher/verify walks the log end-to-end and reports where it broke, and the chain head is published daily.

Warden message provenanceAn HMAC over every message

On send, the server signs the author, the message id, its content and its time with a Warden-only key, and re-signs on every edit made through the app. /warden/messages/:id/verify recomputes and compares — a message changed outside the app verifies as tampered. Signing went live on 3 September 2026; messages from before that verify as unsigned, not as tampered.

Tripwire honeytokensCanary invites and admin routes

Fake invite codes, fake admin endpoints and fake DM threads planted across the API. Anyone touching one is acting on data they should never have — an automatic flag and a Cipher entry. Catches insider threats and scrapers that enumerate.

Vault encryptionSealed per row

Sensitive columns sit behind a versioned encryption layer. Message and DM content, session metadata, IP addresses and user agents are sealed per row with AES-256-GCM under a key derived from a keyring that never enters the database; a value cannot be replayed onto another row.

Per-user rate limitingKeyed on the account

IP-based limiting alone fails against botnets. Authenticated routes are keyed on the account in Redis, so a botnet spread across many addresses still shares one bucket per account. DMs, search and uploads have their own.

WatchguardAutomatic attacker blocking

Watches per-address request floods and error velocity in-process and hard-blocks an attacking address with escalating timeouts, from 15 minutes to 24 hours — always temporary, never an account. Shared addresses (a carrier NAT, a campus) are never auto-blocked.

CaptchaEncrypted SVG, one-time tokens

SVG captchas with DOM scrambling, an encrypted payload and one-time encrypted tokens. Required on friend requests, server creation and server joining — the parts of the platform that get hit hardest by automation.

Device forensicsConsent-gated

Canvas and WebGL signals, screen and timezone, and hardware specs combine to recognise a device across addresses and rotations, so a banned device cannot come back with a new account. Identifiers are collected only after you have read the disclosure; the hash alone otherwise.

Raid protection and malware scanningAuto lockdown, ClamAV

A raid detector watches join velocity; a spike rate-limits new joins, and the owner can lock the server outright from the raid settings. Every uploaded file is handed to ClamAV: anything infected is quarantined, never served.

Two-factor and hashed tokensTOTP, rotated refresh tokens

TOTP two-factor with single-use backup codes. Refresh tokens are hashed at rest, rotated on use and revoked when an account is terminated or its password changes. Ending your other sessions drops their live connections at once, cluster-wide.

Account lifecycle30-minute purge

Unverified accounts are deleted 30 minutes after sign-up, which keeps the database clean and starves email-spam vectors. A terminated account has its tokens and sessions revoked together.