On-device bot defense: a tiny neural model scores every visitor locally, with proof-of-work step-up for low-trust devices.
Bluetick runs entirely in the visitor's browser. It collects ~20 signals (automation markers, headless UA, touch spoofing, mouse entropy, typing cadence, canvas/WebGL/audio fingerprint), feeds them to a 20→8→1 sigmoid network (~2KB weights, sub-millisecond inference, works offline), and blends the result with per-device history. Scores map to Protected (60+), Verified (30+), or Challenge (<30). Nothing biometric ever leaves the browser — only the score and fired flags are beaconed to /api/security/track.
Low-trust visitors must find a SHA-256 nonce (~65k hashes, 1–3 seconds on real hardware) before continuing — trivial once for a human, expensive at bot scale. The Continue button, billing purchases, and flagged API flows stay locked until a valid proof is presented, and the server re-verifies every proof.
The floating Bluetick badge scores every page. Dashboard → Security shows the live device-trust card with fired signals. Dashboard topbar carries the compact trust chip. Billing gates purchases behind a solved challenge for low-trust devices. Admin → Users shows each user's recent trust events and flags.