Is it a WAF, a CDN, or a CAPTCHA?

No to all three. Gate is not a web application firewall - it does not inspect payloads for injection or apply signature rules to request bodies. It is not a CDN and does not cache or distribute your content. It is not a CAPTCHA vendor: the score-based proof-of-work step it can raise is a computational check on the client, not an image or puzzle test, and proof of work is not a CAPTCHA. Gate complements these tools rather than replacing any of them.

What can it reliably stop?

Gate reliably flags and blocks common automation stacks that carry observable tells: Selenium, Puppeteer, Playwright, and undetected-chromedriver; headless-browser markers; TLS fingerprint parrots that do not match their claimed client; and naive proxy or datacenter-IP farms. These are promoted toward CHALLENGE or DENY by enforcement rules and layered scoring. Detection reflects a reference-measured signal set, not an unbounded guarantee.

Frequently asked questions

Q: What can it NOT detect?

The honest boundary is the coherent browser or human-assisted automation ceiling: a coherent, real browser engine driven to spoof every layer consistently, arriving from residential proxies, is not solved. When automation presents a genuine engine with matching TLS, fingerprints, and interaction signals over a residential address, there is no clean tell to key on. Gate mitigates this case only by rate and reputation - metering repeat attempts per fingerprint and subnet - not by clean detection. We name this plainly rather than imply it is covered.

Diátaxis quadrant: Reference. Audience: integrators, evaluators, operators, privacy reviewers, and people comparing adjacent controls.

Straight answers about what humanymous Gate does, what it does not, and where its limits are.

What is humanymous?

humanymous is a defensive, open-source reference system for studying browser-automation detection. The standalone Core engine demonstrates the complete seven-stage pipeline. Gate is the reverse-proxy enforcement component; it applies the same scoring implementation to the smaller evidence set its current collector actually supplies, then records and enforces the resulting verdict at the edge.

Is it a web application firewall, content delivery network, or interactive verification service?

No to all three. Gate is not a web application firewall: it does not inspect payloads for application exploits. It is not a content delivery network and does not cache or distribute content. Its proof-of-work challenge demonstrates computation, not that a person is present, and the reference does not provide a complete user-solvable recovery path for every CHALLENGE. Gate complements these controls rather than replacing them.

What evidence does it handle well?

Core’s reference profiles cover common browser drivers, headless-browser markers, and client claims that disagree with directly observed protocol behavior. Gate shares the scoring implementation but supplies a narrower evidence set, so evaluate Gate against the proxy you will deploy rather than using a Core catalog result as a Gate claim. Enforcement rules and risk thresholds can produce CHALLENGE or DENY; neither outcome proves automation.

What can it not detect reliably?

The coherent-automation detection boundary is explicit: client and network signals alone cannot reliably separate internally consistent real-browser or human-assisted automation from legitimate traffic. Gate raises cost with request metering, reputation, and attested-route verification; it does not claim a clean detection answer for this class.

Is it production-ready?

No — humanymous Gate is a reference implementation, not a production-hardened product. It ships an in-memory development certificate, single-node state by default, and ephemeral keys unless you configure a sealed keystore. Behaviors a production install would need — real certificate issuance, shared fleet state, a managed KMS/HSM — are intentionally out of scope and labeled production responsibility throughout the documentation. Treat it as something to study, run, and extend, not as a drop-in production shield.

Can I run it without building from source?

Yes. Prebuilt images are published to GitHub Container Registry, so you can run Gate with no Go toolchain and no source tree. Pull ghcr.io/modootoday/humanymous-gate:latest — it is multi-arch (linux/amd64 + linux/arm64, so it runs natively on Intel/AMD and ARM) and cosign-signed. A monitor-mode one-liner in front of your origin looks like this:

docker run -d -p 8444:8444 -p 127.0.0.1:8445:8445 \
  ghcr.io/modootoday/humanymous-gate:latest \
  -addr :8444 -admin-addr :8445 -upstream http://YOUR-ORIGIN:PORT -monitor

:latest tracks the newest release. See Run from the published image for the full walkthrough (including the local-demo token switch), and for a production deployment — ACME TLS, a sealed keystore, and a durable audit log — use the pull-only deployments/compose.release.yaml, which references the published image directly. The detection engine is published too, as ghcr.io/modootoday/humanymous-core:latest, for standalone self-testing and the demo.

Does it use CAPTCHAs?

No third-party CAPTCHA service is required. The reference includes proof-of-work and Pass components, but Gate does not wire them into a complete recovery flow for every challenged visitor. A deployment must provide and test the accessible flow it intends to use. A proof-of-work result can clear only a score-based challenge; it never overrides a rule-promoted verdict.

How is a verdict decided?

Core demonstrates the complete seven-stage pipeline. Gate scores the evidence its current collector supplies and maps the result to ALLOW, CHALLENGE, or DENY. Enforcement rules can raise that score-based result. Strict and attested routes fail closed when Gate cannot form a verdict. A valid proof-of-work result can upgrade only a score-based CHALLENGE, and production operators must wire the surrounding visitor flow.

Does it need a CDN, and where does it sit?

Gate sits inline as a reverse proxy in front of your origin: it terminates TLS, streams a detection bundle into your HTML responses, scores the request, enforces the verdict at the edge, and only then forwards allowed traffic to your origin. It does not require a CDN and can run directly ahead of your application. Because part of its signal comes from the raw TLS handshake, it needs to terminate TLS itself rather than sit behind a layer that has already done so.

What about false positives?

Some real users can be challenged or, rarely, denied — the design accepts a bounded false-positive rate rather than claiming zero. Low-confidence signals are weighted weakly to keep that rate down, and monitor mode lets you observe what would be challenged or denied against real traffic before you enforce. The published false-positive figure is reference-measured and reported against DENY only; it is not a promise for your traffic mix. Heuristic enforcement rules — such as one keyed on no interaction over a window — can catch some humans, which is why tuning in monitor mode comes first.

Gate stores raw identifiers only as per-subject pseudonyms — this is pseudonymous, not anonymous — and records decisions in a tamper-evident audit log. It supports right-to-erasure through cryptographic erasure (crypto-shred), which destroys the per-subject linkage key so records can no longer be re-identified while the audit chain stays verifiable. These capabilities help you meet GDPR obligations; they do not by themselves make your overall processing compliant.

Is it a self-hosted alternative to DataDome, Cloudflare Bot Management, or Kasada?

Not a like-for-like replacement. Those are managed, production commercial services with global networks, hosted threat intelligence, and operational support. humanymous Gate is an open-source reference implementation with a different scope: something you self-host, read end to end, and adapt, with its detection boundaries stated openly. If you need a supported production service today, a commercial vendor is the better fit; if you want a transparent, hackable engine to learn from or build on, that is what this is.

What licence is it under?

humanymous Gate is released under the Apache License 2.0. You may use, modify, and redistribute it under that licence’s terms, including its patent grant and attribution requirements.