This is the biggest rewrite of Cap, ever. A rebuilt dashboard, per-request analytics, rules, lists, webhooks, and bot and AI agent detection on top of the proof of work.
Upgrading from 3.x needs a few manual steps. Site secrets, API keys and dashboard sessions from v3 have to be reset, and older compose files need a data volume. Migrating from v3 to v4
Analytics
Capd now uses ClickHouse or DuckDB to store every challenge, solve, block and rate limit event with its country, network, platform, browser, risk score and solve time.
Protection
Detect a wide range of bots and automation tools, and block them with a challenge or block. Capd can now detect scripted clicks, robotic movements and dozens of AI agents.
Breaking changes
- Secrets have been switched to SHA-256
- Analytics now use Clickhouse or DuckDB. Events need a volume at
/usr/src/app/data. Per-country, per-network and per-platform history from v3 will be lost due to changes in how events are stored - The env vars
CORS_ORIGIN,RATELIMIT_IP_HEADER,ENABLE_ASSETS_SERVER,WIDGET_VERSIONandWASM_VERSIONare now dashboard settings. - The env vars
DEMO_MODE,RSW_BITS,SHOW_ERRORS,DISABLE_ERROR_LOGGINGandHIDE_RATELIMIT_IP_WARNINGhave been removed.