Changelog

August 2026 — IP privacy relay detection

API

• New IP signal signals.ip.relay for privacy relay egress (distinct from VPN and proxy).
• Maps to the existing public reason code ip_anonymizer.
• Use signals.ip.relay vs signals.ip.vpn when you need relay-specific policy; anonymizer reasons still dedupe to one public entry.

---

August 2026 — Spam domain reputation

API

• New email signal signals.email.spam_domain for domains with spam or abuse reputation (distinct from disposable and relay).
• Public reason code email_reputation.
• Orthogonal to disposable and relay: flags may stack independently.

---

August 2026 — Relay domain detection

API

• New email signal signals.email.relay_domain for forwarding / alias providers (SimpleLogin, Firefox Relay, AnonAddy, DuckDuckGo Email Protection, Apple Hide My Email, and related domains).
• Public reason code email_relay.
• Orthogonal to disposable: both booleans may be true when a domain appears on both lists.

---

June 2026 — Public reason categories

API (breaking for public reasons[].code)

• Public reason codes are now middle-tier categories (e.g. ip_anonymizer, ip_reputation, velocity_ip) instead of detector-specific names like ip_tor_exit_node or velocity_ip_signups.
• signals unchanged — use signals.ip.tor, signals.ip.vpn, etc. for advanced custom policies.
• Dashboard assessments show detailed reason codes with weight and detail.

---

May 2026 — Optional IP

API

• POST /v1/assess: ip is now optional. Send the end user's public IP for full network and velocity checks.
• Loopback, private, and localhost values are accepted but not used for scoring. The response includes ip_provided and ip_status.
• When no usable IP is available, signals.ip is omitted from the response.

Docs

• New guide: Getting the client IP.

---

May 2026 — Initial release

The first public ShieldSignup release.

API

• POST /v1/assess — risk-score a signup by email and IP. Returns verdict, score, reasons[], and a nested signals object covering email, IP, and velocity sources.
• GET /v1/assess/:request_id — fetch a previously stored assessment. Does not deduct quota.
• POST /v1/feedback — report a false_positive or false_negative for an assessment. One record per assessment (upsert).
• GET /v1/usage — current monthly quota usage for the authenticated API key.

Reason codes emitted

• Email: email_disposable, email_no_mx, email_role_account, email_plus_alias, email_free_provider.
• IP: ip_tor_exit_node, ip_datacenter, ip_high_abuse_score, ip_stopforumspam.
• Velocity: velocity_ip_signups, velocity_domain_signups.

Dashboard

• API key management (create, name, revoke).
• Assessments log with score, verdict, and reason badges.
• Usage overview with daily verdict breakdown and monthly quota progress.
• Configurable score thresholds — account-wide and per API key.
• Self-serve billing portal (Stripe), Free / Starter / Pro plans.

Rate limits

• Free 1 rps / 1,000 monthly assessments.
• Starter 10 rps / 10,000.
• Pro 50 rps / 100,000.
• Business 200 rps / 1,000,000 (sales-assisted).
• 3× burst budget on the per-second limit, 5-second sliding window.
• Rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Quota-Used, X-Quota-Limit) on every successful response.