{ "stable": true, "versions": { "1.0.5": { "manifest": { "id": "com.katsuricata.hecapte", "title": "HeCAPTe", "author": "Kat Suricata", "description": "HeCAPTe provides a stateless spam-prevention mechanism that respects user privacy. Unlike traditional CAPTCHAs that rely on tracking user behavior or forcing users to complete busywork, HeCAPTe requires the user’s system to solve a computational puzzle (Equihash). This “Proof-of-Work” approach makes it computationally expensive for bots to generate mass requests while remaining quick for legitimate human users on modern devices.\n\n- **Humane:** Requires no additional human interaction and presents no impediment to accessibility. Doesn’t try to extract value from the user by having them train image recognition models. Doesn’t infuriate vision-impaired users with audio from the first prototype of the telephone.\n- **Embeddable:** Requires nothing more than one small Go binary, a few static files (including the .wasm solver), and an SQLite database. Even the cheapest VPS can run it without a hitch.\n- **Cost-Asymmetric:** Expensive to solve, cheap to verify.\n- **Proof-of-work:** HeCAPTe uses Equihash, a memory-hard proof-of-work algorithm. Unlike simple SHA256-based puzzles, Equihash’s memory requirements make it significantly more costly to solve at scale.\n- **Turing exam:** Not quite a Turing *test.* Any one user submission is not, as per the original CAPTCHA vision, “proof” of humanity—but in a world with advanced OCR, services that have underpaid laborers type in answers for fractions of a penny, and even tiny local AI models that can easily solve most natural language puzzles, that vision is likely dead anyway.\n\nDon’t try to barricade the way for bots and stop humans along the way; just make it more expensive to spam you than they could possibly get back as profit.", "tagline": "Stateless, privacy-first, embeddable proof-of-work CAPTCHA.", "version": "1.0.5", "upstreamVersion": "1.3", "minBoxVersion": "9.1.0", "healthCheckPath": "/", "httpPort": 8080, "website": "https://codeberg.org/TheMeerkat/HeCAPTe", "addons": { "localstorage": {} }, "postInstallMessage": "Please set an admin password at $CLOUDRON-APP-ORIGIN/admin as soon as possible.", "configurePath": "/admin/", "icon": "file://icon.png", "manifestVersion": 2, "contactEmail": "kat@katsuricata.com", "iconUrl": "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/hecaptesmall.webp", "packagerName": "Kat Suricata", "packagerUrl": "https://KatSuricata.com/", "changelog": "* fix regression related to TLS in 1.0.2\n", "tags": [ "hosting" ], "mediaLinks": [ "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20%281%29.png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(2).png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(3).png" ], "dockerImage": "codeberg.org/themeerkat/hecapte-cloudron:20260309-193119-231ee3613" }, "creationDate": "Mon, 09 Mar 2026 19:39:08 GMT", "ts": "Mon, 09 Mar 2026 19:39:08 GMT", "publishState": "published" }, "1.1.0": { "manifest": { "id": "com.katsuricata.hecapte", "title": "HeCAPTe", "author": "Kat Suricata", "description": "HeCAPTe provides a stateless spam-prevention mechanism that respects user privacy. Unlike traditional CAPTCHAs that rely on tracking user behavior or forcing users to complete busywork, HeCAPTe requires the user’s system to solve a computational puzzle (Equihash). This “Proof-of-Work” approach makes it computationally expensive for bots to generate mass requests while remaining quick for legitimate human users on modern devices.\n\n- **Humane:** Requires no additional human interaction and presents no impediment to accessibility. Doesn’t try to extract value from the user by having them train image recognition models. Doesn’t infuriate vision-impaired users with audio from the first prototype of the telephone.\n- **Embeddable:** Requires nothing more than one small Go binary, a few static files (including the .wasm solver), and an SQLite database. Even the cheapest VPS can run it without a hitch.\n- **Cost-Asymmetric:** Expensive to solve, cheap to verify.\n- **Proof-of-work:** HeCAPTe uses Equihash, a memory-hard proof-of-work algorithm. Unlike simple SHA256-based puzzles, Equihash’s memory requirements make it significantly more costly to solve at scale.\n- **Turing exam:** Not quite a Turing *test.* Any one user submission is not, as per the original CAPTCHA vision, “proof” of humanity—but in a world with advanced OCR, services that have underpaid laborers type in answers for fractions of a penny, and even tiny local AI models that can easily solve most natural language puzzles, that vision is likely dead anyway.\n\nDon’t try to barricade the way for bots and stop humans along the way; just make it more expensive to spam you than they could possibly get back as profit.", "tagline": "Stateless, privacy-first, embeddable proof-of-work CAPTCHA.", "version": "1.1.0", "upstreamVersion": "1.4", "minBoxVersion": "9.1.0", "healthCheckPath": "/", "httpPort": 8080, "website": "https://codeberg.org/TheMeerkat/HeCAPTe", "addons": { "localstorage": {} }, "postInstallMessage": "Please set an admin password at $CLOUDRON-APP-ORIGIN/admin as soon as possible.", "configurePath": "/admin/", "icon": "file://icon.png", "manifestVersion": 2, "contactEmail": "kat@katsuricata.com", "iconUrl": "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/hecaptesmall.webp", "packagerName": "Kat Suricata", "packagerUrl": "https://KatSuricata.com/", "changelog": "* Add alias domain support (multiDomain) for serving one HeCAPTe instance via multiple domains\n* Fix cookie Secure flag for reverse proxy deployments (X-Forwarded-Proto)\n* Use canonical RPID for WebAuthn in multi-domain setups\n* Redesign UI with tech-dystopian visual theme with Bunny.net fonts (Cairo Play, Fira Code, Fira Sans), bracket notation headings, scanline overlays, and card accent styling\n* Add light mode theme (Gruvbox Light Soft) with full CSS variable mapping\n* Replace browser prompt/confirm dialogs with accessible modal dialogs (focus trapping, ESC key handling, focus restoration)\n* Add skip-link for keyboard navigation and semantic HTML landmarks\n* Improve accessibility: focus rings, reduced motion handling, aria attributes, responsive table patterns\n* Note: admins who registered passkeys on alias domains before this update may need to re-register\n", "tags": [ "hosting" ], "mediaLinks": [ "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20%281%29.png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(2).png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(3).png" ], "multiDomain": true, "dockerImage": "codeberg.org/themeerkat/hecapte:20260422-090118-254d74cc2" }, "creationDate": "Wed, 22 Apr 2026 09:04:22 GMT", "ts": "Wed, 22 Apr 2026 09:04:22 GMT", "publishState": "published" }, "2.0.0": { "manifest": { "id": "com.katsuricata.hecapte", "title": "HeCAPTe", "author": "Kat Suricata", "description": "HeCAPTe provides a stateless spam-prevention mechanism that respects user privacy. Unlike traditional CAPTCHAs that rely on tracking user behavior or forcing users to complete busywork, HeCAPTe requires the user’s system to solve a computational puzzle (Equihash). This “Proof-of-Work” approach makes it computationally expensive for bots to generate mass requests while remaining quick for legitimate human users on modern devices.\n\n- **Humane:** Requires no additional human interaction and presents no impediment to accessibility. Doesn’t try to extract value from the user by having them train image recognition models. Doesn’t infuriate vision-impaired users with audio from the first prototype of the telephone.\n- **Embeddable:** Requires nothing more than one small Go binary, a few static files (including the .wasm solver), and an SQLite database. Even the cheapest VPS can run it without a hitch.\n- **Cost-Asymmetric:** Expensive to solve, cheap to verify.\n- **Proof-of-work:** HeCAPTe uses Equihash, a memory-hard proof-of-work algorithm. Unlike simple SHA256-based puzzles, Equihash’s memory requirements make it significantly more costly to solve at scale.\n- **Turing exam:** Not quite a Turing *test.* Any one user submission is not, as per the original CAPTCHA vision, “proof” of humanity—but in a world with advanced OCR, services that have underpaid laborers type in answers for fractions of a penny, and even tiny local AI models that can easily solve most natural language puzzles, that vision is likely dead anyway.\n\nDon’t try to barricade the way for bots and stop humans along the way; just make it more expensive to spam you than they could possibly get back as profit.", "tagline": "Stateless, privacy-first, embeddable proof-of-work CAPTCHA.", "version": "2.0.0", "upstreamVersion": "2.0.0", "minBoxVersion": "9.1.0", "healthCheckPath": "/", "httpPort": 8080, "website": "https://codeberg.org/TheMeerkat/HeCAPTe", "addons": { "localstorage": {} }, "postInstallMessage": "Please set an admin password at $CLOUDRON-APP-ORIGIN/admin as soon as possible.", "configurePath": "/admin/", "icon": "file://icon.png", "manifestVersion": 2, "contactEmail": "kat@katsuricata.com", "iconUrl": "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/hecaptesmall.webp", "packagerName": "Kat Suricata", "packagerUrl": "https://KatSuricata.com/", "changelog": "* Fix demo page not working: move script from to end of so DOM elements exist before JS runs\n* Add Content-Type header to verify POST request\n", "tags": [ "hosting" ], "mediaLinks": [ "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20%281%29.png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(2).png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(3).png" ], "multiDomain": true, "dockerImage": "codeberg.org/themeerkat/hecapte:20260422-093429-1288e2936" }, "creationDate": "Wed, 22 Apr 2026 09:35:10 GMT", "ts": "Wed, 22 Apr 2026 09:35:10 GMT", "publishState": "published" }, "3.0.0": { "manifest": { "id": "com.katsuricata.hecapte", "title": "HeCAPTe", "author": "Kat Suricata", "description": "HeCAPTe provides a stateless spam-prevention mechanism that respects user privacy. Unlike traditional CAPTCHAs that rely on tracking user behavior or forcing users to complete busywork, HeCAPTe requires the user’s system to solve a computational puzzle (Equihash). This “Proof-of-Work” approach makes it computationally expensive for bots to generate mass requests while remaining quick for legitimate human users on modern devices.\n\n- **Humane:** Requires no additional human interaction and presents no impediment to accessibility. Doesn’t try to extract value from the user by having them train image recognition models. Doesn’t infuriate vision-impaired users with audio from the first prototype of the telephone.\n- **Embeddable:** Requires nothing more than one small Go binary, a few static files (including the .wasm solver), and an SQLite database. Even the cheapest VPS can run it without a hitch.\n- **Cost-Asymmetric:** Expensive to solve, cheap to verify.\n- **Proof-of-work:** HeCAPTe uses Equihash, a memory-hard proof-of-work algorithm. Unlike simple SHA256-based puzzles, Equihash’s memory requirements make it significantly more costly to solve at scale.\n- **Turing exam:** Not quite a Turing *test.* Any one user submission is not, as per the original CAPTCHA vision, “proof” of humanity—but in a world with advanced OCR, services that have underpaid laborers type in answers for fractions of a penny, and even tiny local AI models that can easily solve most natural language puzzles, that vision is likely dead anyway.\n\nDon’t try to barricade the way for bots and stop humans along the way; just make it more expensive to spam you than they could possibly get back as profit.", "tagline": "Stateless, privacy-first, embeddable proof-of-work CAPTCHA.", "version": "3.0.0", "upstreamVersion": "3.0.0", "minBoxVersion": "9.1.0", "healthCheckPath": "/", "httpPort": 8080, "website": "https://tangled.org/katsuricata.com/HeCAPTe", "addons": { "localstorage": {} }, "postInstallMessage": "Set an admin password at $CLOUDRON-APP-ORIGIN/admin as soon as possible.", "configurePath": "/admin/", "icon": "file://icon.png", "manifestVersion": 2, "contactEmail": "kat@katsuricata.com", "iconUrl": "https://mirror.tangled.network/xrpc/sh.tangled.git.temp.getBlob?path=hecaptesmall.webp&ref=main&repo=did%3Aplc%3Apomgtubhgnuew7wmpwgk7dzd", "packagerName": "Kat Suricata", "packagerUrl": "https://KatSuricata.com/", "changelog": "* Moved the project home to https://tangled.org/katsuricata.com/HeCAPTe and the container image to Docker Hub (katsuricata/hecapte).\n* Fixed browser-flow regressions from 2.0.0: the first-run setup page now loads wasm_exec.js, and the password page loads admin.js, restoring setup and passkey reauthentication through the UI.\n* Added an Equihash difficulty floor (crypto.MinN = 60) enforced during validation, challenge signing, and verification; weak settings now log warnings and are flagged on the dashboard.\n* Added per-IP rate limiting on the unauthenticated admin endpoints (10 req/min on challenge fetches, 5 req/min on login POST), honoring X-Forwarded-For only behind TRUST_PROXY=1.\n* Added security response headers (X-Content-Type-Options, frame-ancestors, X-Frame-Options, Referrer-Policy).\n* Added a startup warning when X-Forwarded-Proto arrives but TRUST_PROXY is unset.\n* Upgraded modernc.org/sqlite from 1.55.0 to 1.56.0 and bound the WebAuthn reauthentication token map.\n", "tags": [ "hosting" ], "mediaLinks": [ "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20%281%29.png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(2).png", "https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/screenshots/screenshot%20(3).png" ], "multiDomain": true, "dockerImage": "docker.io/katsuricata/hecapte:20260807-234113-7693a460c" }, "creationDate": "Fri, 07 Aug 2026 23:45:37 GMT", "ts": "Fri, 07 Aug 2026 23:45:37 GMT", "publishState": "published" } } }