CodeCow/stack
1
0
Fork 0
mirror of https://github.com/stack-auth/stack.git synced 2026-07-20 21:29:36 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

remove mentions of turnstile scores

Browse Source
This commit is contained in:
Madison 2026-07-17 04:37:32 -05:00
parent e16dd0a73c
commit af605b7d28
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docs-mintlify/guides/apps/authentication/fraud-protection.mdx
View File

@ -4,7 +4,7 @@ description: "Detect bots, free-trial abuse, and other fraudulent sign-ups."
sidebarTitle: "Fraud Protection"
---
Fraud Protection is a sub-app of [Authentication](./overview). It isn't a separate page or a separate toggle - it's the name we give to the **risk signals** that the Authentication app already attaches to every sign-up attempt (bot score, free-trial abuse score, geo-IP country, and Cloudflare Turnstile result), and the conditions you can write against them in [Sign-up Rules](./sign-up-rules).
Fraud Protection is a sub-app of [Authentication](./overview). It isn't a separate page or a separate toggle - it's the name we give to the **risk signals** that the Authentication app already attaches to every sign-up attempt (bot score, free-trial abuse score, and geo-IP country), and the conditions you can write against them in [Sign-up Rules](./sign-up-rules).
In the dashboard, Fraud Protection appears as its own tile (grouped under the Authentication category) with a **Go to Authentication** button that takes you straight to **Authentication → Sign-up Rules**. There's nothing to configure on a separate screen - everything happens in the rule builder.
@ -19,10 +19,8 @@ Every sign-up attempt is scored with the following fields. They're always availa
| Field | Type | Operators | Description |
|---|---|---|---|
| `countryCode` | string (ISO-3166-1 alpha-2) | `equals`, `not_equals`, `in_list` | Geo-IP country of the request (e.g. `"US"`, `"DE"`, `"NG"`). Empty if it can't be resolved. |
| `riskScores.bot` | number (0-100) | `equals`, `not_equals`, `greater_than`, `greater_or_equal`, `less_than`, `less_or_equal` | Confidence that the sign-up is automated. Higher = more likely a bot. Hexclave uses signals like the Cloudflare Turnstile verdict to compute this score. |
| `riskScores.free_trial_abuse` | number (0-100) | same as `riskScores.bot` | Confidence that the user is attempting to abuse a free-trial / new-account incentive (multi-accounting, disposable infra, etc.). |
The rule tester additionally exposes a **Turnstile** override (`ok` / `invalid` / `error`) so you can simulate how a given Turnstile verdict affects the resulting bot score.
| `riskScores.bot` | number (0-100) | `equals`, `not_equals`, `greater_than`, `greater_or_equal`, `less_than`, `less_or_equal` | Confidence that the sign-up is automated. Higher = more likely a bot. |
| `riskScores.free_trial_abuse` | number (0-100) | same as `riskScores.bot` | Confidence that the user is attempting to abuse a free-trial / new-account incentive. |
These fields evaluate together with the rest of the sign-up context, so a single rule can combine them freely.
@ -64,7 +62,6 @@ The Sign-up Rules **rule tester** (button **Open tester** at the bottom of the p
- **Country** - override the resolved country code (any ISO-3166-1 alpha-2).
- **Bot score** - 0–100. Must be provided together with **Free-trial abuse** or both must be blank.
- **Free-trial abuse** - 0–100. Same pairing rule as Bot score.
- **Turnstile** - `Default (real result)` / `OK` / `Invalid` / `Error`. The tester doesn't run a live Turnstile check; when left at the default, the simulated verdict falls back to `Invalid` for score derivation, so set an explicit value to model a passing challenge.
Click **Run test** to see how each rule evaluates against the simulated context. The result panel shows: