Effective bot protection without CAPTCHAs.
The Vinishu SDK checks your users' browsers and looks for a bot hiding behind them. Each user gets a session, and your API uses it to ask Vinishu whether that user is real.
It couldn't be much simpler.
You make changes in two files: your layout or HTML page once, plus every route you want to protect.
Changes in two files. Six lines with our package. No DNS change.
- app/layout.tsxonce
<body>{children}<script src="https://sdk.vinishu.io/v3.js" async></script></body>Once in your layout, it runs on every page. The script loads async and stores a session in the browser's cookies.
- app/api/login/route.tsper route
import type { NextRequest } from "next/server";import { verify } from "@vinishu/sdk";export async function POST(req: NextRequest) {const v = await verify(req);if (!v.valid) {return Response.json({ error: "denied" }, { status: 403 });}// your login logic, unchanged}import type { NextRequest } from "next/server";export async function POST(req: NextRequest) {const res = await fetch("https://api.vinishu.io/verify", {method: "POST",body: JSON.stringify({ cookie: req.cookies.get("vn_id")?.value }),});// The answer is { valid, score }. valid is false if a bot sent this request.const v = await res.json();if (!v.valid) {return Response.json({ error: "denied" }, { status: 403 });}// your login logic, unchanged}Your handler checks the session before your code runs. You decide what happens on a bot flag. Here it's a 403 response. Do this in every route you want to protect.
Lines starting with + are added. The rest is already in your code.
What your server gets from us.
This is an example of what a verify response from us looks like. It's easy to process, and if you need more information, you can get it through the IDs.
{ "valid": true, "score": 98, "fingerprint_id": "fp_8c21ae4d7b", "session_id": "sn_4f90bd12c8"}valid- Real or automated. This field is our assessment. Your route still has to apply it to how the request continues.
score- 0 is definitely a bot, 100 is a human. Use the value to set your own threshold. There's more on that in our docs.
fingerprint_id- Use it to look up details about the browser. For security engineers who want to add measures of their own.
session_id- The ID of the generated session. It answers the “why?”: search for this ID in the dashboard and you see the exact reasons for our assessment.
These fields reach your server. Whether you use the IDs is entirely up to you. You don't need them to run Vinishu.
No answer - now what?
There's no such thing as “never happens”. Our terms commit us to our availability, but some outages nobody can see coming. What happens then is up to you.
No answer inside your timeout - your server handles the request as usual. That's our recommendation: this way we never cause you downtime. Bots get through too, though.
Your users keep their access and never notice the outage.
As long as the timeout runs, our protection is gone. A bot that hits your site in that window isn't checked.
const v = await verify(id).catch(() => ({ valid: true, degraded: true }));You have to decide which position is right. That's a decision we can't make for you.
What you get.
The core features of the Vinishu SDK. Quick, at a glance.
Detection
Extended analysis
We re-check the browser and its IP all the time. TLS signals and request headers get scored in a fraction of a second. If what a browser claims to be changes, we notice.
TLS detection
We check TLS data in the millisecond the challenge is posted to us. So we can tell you right away whether the data is forged.
Enforcement
Custom rules
You decide whether certain IPs or HTTP headers always get through. The rules are easy to set up.
Rate limiting before the expensive work
The SDK doesn't keep requests off your server, but it stops them from eating expensive server work there.
Performance
Low latency
Right now Vinishu runs only on servers in the EU. Each request goes to the closest server there. Soon Vinishu will support regions outside the EU too, with EU fencing.
Decision in milliseconds
Whether the user is a bot gets decided while the script loads. When you need the result, it's there within a few milliseconds and adds no latency.
Operations
Explainable decisions
In the dashboard you can trace every request, every decision and every block, with the reason. You don't have to wait for a batched report.
Simple management
Invite your team in a few clicks and give them access to Vinishu. That way the work isn't all on you.
What the SDK can't do.
Three things people ask about regularly that an SDK can't do by design. It runs inside your application, not in front of it.
No DDoS absorption.
The request reaches your server. By checking the session with us, you decide what it costs you there - not whether it arrives.
Reverse ProxyComing soon
Rate limiting only indirectly.
We stop a bot from reading out your database: you block it with our result. We don't stop it from sending requests in the first place.
Reverse ProxyComing soon
No TLS termination.
We can't run TLS checks in front of your server. That will be the job of the reverse proxy, which is coming soon.
Reverse ProxyComing soon
If you need one of these anyway, we can help: we protect you with the SDK for now, and once the reverse proxy is here, we switch your contract over. Just talk to us.
What happens when your service goes down?
You decide that. Even if the chance of it is very small, it's worth thinking about. We explain it in more detail further up this page.
How much latency does it add?
A few milliseconds, because the decision whether the user is real was made long before you ask us. We only hand you the finished result.
Does the script slow my site down?
No. The script tag loads async and doesn't block the page from rendering. It draws nothing, opens no pop-ups and doesn't hook into your forms. All it does is store a session in the cookies, which your server can check with us later.
What do you see of my users?
Browser signals, request metadata and behavioural signals, no content. We don't see what your users type, confirm or select. Passwords and other data stay confidential between you and your users.
Which languages and frameworks?
We offer ready-made integration packages for several languages. On request, we also build the integration for your use case. Then again, it's only a simple HTTP request.
Can I just watch my traffic without blocking?
Yes, that's exactly what you do in the pilot phase. You can keep doing it afterwards, of course. We give you an analysis endpoint so you can find out how big your bot load really is.
Do I have to change my DNS settings?
No. The SDK comes straight from our servers and is loaded externally, so you don't have to change anything in your domain settings.
What does it cost?
A fixed monthly price, depending on how many domains you run and how many sessions get created on your site each month. Anything above the limit is billed on top at a fixed rate. All plans are on the pricing page. Before that, a free pilot runs to find the right plan for you.
Swap your CAPTCHAs for invisible protection.
Add the script tag and an HTTP request in your API, and bot protection is on. Our team helps you set it up. Then you test Vinishu in a two-week pilot, with a traffic analysis at the end.
Find out how exposed you are to bot attacks
Give us the link to your website. We check your public pages and show you every weak spot where we can't see any bot protection. Nothing gets submitted.
- Free
- Passive
- 90 seconds