OpenSentinel (1.1.1 Stable Production Release)

An Azanian Eagle Project

OpenSentinel is a free, radically open-source, and entirely non-invasive CAPTCHA replacement specifically engineered to revolutionise the cybersecurity market. Built with an absolute commitment to digital sovereignty, it prioritises user privacy, universal accessibility, and uncompromising security without ever degrading the user experience or collecting personally identifiable information.

Quickstart

Get your secure backend and testing environment operational in seconds.

# Clone the repository to your local machine
git clone https://github.com/Azanian-Eagle/OpenSentinel.git
cd OpenSentinel

# Start the self-hosted service with Docker Compose
cp .env.example .env
docker compose up --build

The server binds to http://localhost:8080. Visit that URL to interact with the client interface and confirm service health.

Production Release (1.1.1 - 2026-10-21)

For production deployments, install prebuilt binaries or pull the official release image from GitHub Container Registry:

Install Prebuilt Binaries via Shell Script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Azanian-Eagle/OpenSentinel/releases/download/1.1.1/opensentinel-server-installer.sh | sh

Install Prebuilt Binaries via Homebrew

brew install opensentinel-server

Pull Tagged Docker Image

docker pull ghcr.io/azanian-eagle/opensentinel:v1.1.1

Official Prebuilt Binary Assets

• ARM64 Linux: opensentinel-server-aarch64-unknown-linux-gnu.tar.xz
• x64 Linux: opensentinel-server-x86_64-unknown-linux-gnu.tar.xz
• Apple Silicon macOS: opensentinel-server-aarch64-apple-darwin.tar.xz
• Intel macOS: opensentinel-server-x86_64-apple-darwin.tar.xz
• x64 Windows: opensentinel-server-x86_64-pc-windows-msvc.zip

The release package includes the pre-compiled backend binary, the ONNX machine learning model, client assets, and default configurations. Threat intelligence logs are automatically rotated once they reach the configured THREAT_INTEL_MAX_BYTES limit.

Philosophy & Digital Sovereignty

Traditional CAPTCHA systems force users to solve visual puzzles, effectively conducting unpaid labour to train third-party artificial intelligence models. Legacy solutions rely on invasive tracking cookies, browser fingerprinting, and device profiling that breach fundamental digital privacy.

OpenSentinel fundamentally alters this paradigm: we categorically do not train any third-party AI models or harvest user profiles. Our self-hostable, radically transparent infrastructure respects user dignity. By analysing the natural, mathematical variance of human interaction (such as mouse movement curvature and keystroke flight dynamics) rather than demanding active puzzle solving, we protect web applications while guaranteeing compliance with global privacy regulations (including POPIA, GDPR, and CCPA).

Core Features & Technical Architecture

• Non-Invasive Verification Array: Dynamic client-side telemetry measuring cursor trajectory linearity, velocity variance, and keystroke timing, completely eliminating intrusive image challenges.
• Local AI ONNX Inference: Local execution of Random Forest machine learning models (powered by ort and ndarray), calculating bot probabilities entirely on your sovereign server without sending telemetry to external clouds.
• Client AES-256-GCM & HPKE Ephemeral Encryption: High-resolution sensor payloads are dynamically encrypted on the client side using AES-GCM, SHA-256 Proof-of-Work nonces, and short-lived challenge tokens (GET /challenge).
• Ed25519 Signed Tokens & JWKS Verification: Every successful verification yields an Ed25519-signed JWT token that backend rely parties can verify offline via /.well-known/jwks.json.
• Drop-in Turnstile / reCAPTCHA / hCaptcha Migration: Standard POST /compat/siteverify endpoint allowing immediate 1:1 migration for existing web backends.
• IETF Privacy Pass Protocol Headers: Evaluated requests attach WWW-Authenticate: PrivateToken and Private-Token headers for standard token redemption.
• Cryptographic Proof-of-Work (PoW): Optional client-side PoW computation deters automated script attacks and high-volume DDoS attempts by raising the computational cost for bots.
• Federated Threat Intelligence Network: Peer-to-peer threat signature sharing across instances using Ed25519 cryptographic signatures and dynamic peer discovery (FEDERATION_DISCOVERY_URL).
• Live Observability & Analytics: An authenticated real-time dashboard at /api/dashboard paired with Prometheus-compatible metrics at /metrics, /healthz, and /readyz.
• First-Party SDK Ecosystem: Ready-to-use SDKs with framework middleware helpers for React (@azanian-eagle/opensentinel-react), Python FastAPI/Flask (azanian-eagle-opensentinel), and UMD Vanilla JS (@azanian-eagle/opensentinel-client).
• Cloud-Native Deployment: First-class support for Kubernetes via raw manifests (k8s/) and a production-grade Helm Chart (k8s/helm/opensentinel).

First-Party SDKs & Client Libraries

OpenSentinel offers official packages across ecosystems:

React SDK (@azanian-eagle/opensentinel-react)

npm install @azanian-eagle/opensentinel-react

import React from 'react';
import { useOpenSentinel } from '@azanian-eagle/opensentinel-react';

export const VerificationComponent = () => {
  const { isVerified, isEvaluating, score, verify } = useOpenSentinel({
    endpoints: ['https://api.yourdomain.com/verify'],
    enablePoW: true,
  });

  return (
    <div>
      <button onClick={verify} disabled={isEvaluating}>
        {isEvaluating ? 'Evaluating...' : 'Verify Humanity'}
      </button>

      {isVerified && <p>Verified Human (Score: {score})</p>}
    </div>
  );
};

Python SDK (azanian-eagle-opensentinel)

pip install azanian-eagle-opensentinel

from opensentinel import OpenSentinelClient

client = OpenSentinelClient(endpoint="https://api.yourdomain.com/verify")
# Verify client telemetry backend-side or query status

Vanilla JS / UMD (@azanian-eagle/opensentinel-client)

<script src="/src/sensor.js"></script>
<script>
  OpenSentinel.init({
    endpoints: ['https://api.yourdomain.com/verify'],
    enablePoW: true,
    onSuccess: function(token) { console.log('Human verified'); },
    onFailure: function() { console.warn('Bot detected'); }
  });
</script>

Regulatory Compliance & Data Protection

OpenSentinel guarantees complete compliance with global privacy regulations, including South Africa's Protection of Personal Information Act (POPIA), Europe's General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

• Zero Personally Identifiable Information (PII): No IP logging, browser fingerprinting, or user account tracking.
• Strict Data Minimisation: Evaluates abstract mathematical variance (speed, trajectory, keystroke timing) rather than user identities.
• Local Processing: Machine learning models execute locally on your infrastructure. Telemetry never leaves your controlled network boundary.
• No Cross-Site Tracking: Eliminates cookies and persistent device beacons across sites.

Configuration & Environment Variables

| Variable | Description | Default | |---|---|---| | PORT | HTTP server listening port | 8080 | | PAYLOAD_SECRET_KEY | 64-character hex string (32-byte key) for AES-256-GCM encryption | Required | | ADMIN_TOKEN | Bearer/Basic Auth token for /api/dashboard access | Optional | | FEDERATION_ENABLED | Enable P2P threat intelligence sharing | false | | TRUSTED_PEERS | Comma-separated peer URLs | "" | | TRUSTED_PEERS_PUBKEYS | Comma-separated hex Ed25519 public keys | "" | | NODE_PRIVATE_KEY | Hex Ed25519 private key for signing threat intel payloads | Optional | | NODE_URL | Public URL of this node sent to peers | Optional | | FEDERATION_DISCOVERY_URL | URL to fetch dynamic peer lists | Optional | | RATE_LIMIT_MAX_REQUESTS | Max requests per rate limit window per IP | 60 | | RATE_LIMIT_WINDOW_SECONDS | Rate limit window in seconds | 60 | | OPEN_SENTINEL_MODEL_PATH | Path to model.onnx file | model.onnx | | OPEN_SENTINEL_CLIENT_DIR | Path to client static asset directory | ../client | | OPEN_SENTINEL_DATA_DIR | Data storage directory for threat logs | data | | ALLOWED_ORIGINS | Comma-separated allowed CORS origins | http://localhost:8080,http://127.0.0.1:8080 |

Deployment & Infrastructure Manual

Option 1: Docker Compose

cp .env.example .env
# Edit PAYLOAD_SECRET_KEY in .env
docker compose up -d

Option 2: Kubernetes & Helm Chart

Deploy with raw manifests:

kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml

Or deploy via Helm:

helm install opensentinel k8s/helm/opensentinel \
  --set env.payloadSecretKey="0102030405060708090a0b4c0d0e0f101112131415161718191a1b1c1d1e1f20"

The Helm chart includes production features such as Horizontal Pod Autoscaler (HPA), Prometheus ServiceMonitor, and HashiCorp/AWS ExternalSecrets support.

Testing & Verification

Run the full Rust test suite:

cd server
cargo test --workspace

Run Python integration tests:

pip install playwright cryptography
playwright install
python3 tests/integration_tests.py
python3 tests/fail_safes_test.py

Governance & Community

OpenSentinel is an open-source project licensed under the MIT Licence. Contributions, audits, and security reports are actively welcomed.

• Contributing: See CONTRIBUTING.md for guidelines.
• Code of Conduct: See CODE_OF_CONDUCT.md.
• Security Policy: Report security issues according to SECURITY.md.

Licence

MIT