SCaptcha 2.3.0 changelog

Name: SCaptcha
Author: SoftCreatR Media

Released on 8 September 2026. These are the changes in SCaptcha 2.3.0.

Fresh challenges and bounded reuse

Every new Proof-of-Work challenge now has an independent, cryptographically random 32-byte salt. Salt, hash, algorithm, answer, and HMAC are validated together against the issuing WoltLab session. Challenges expire after 60 seconds and fail if modified or moved to another session.
Challenges created by 2.2.x immediately before an update remain valid only until their normal 60-second expiry. Pre-submit verification creates a one-use, path-bound session marker for 300 seconds; text/audio proofs also expire after 300 seconds.
Form reuse, the Under-Attack access cookie, and Sentinel's deny cookie remain separate. Under-Attack uses a signed, user-agent-bound cookie for 300–1,800 seconds (600 by default). Sentinel's server-decided deny cookie lasts 600 seconds.

Proxycheck.io v3 normalization now retains risk, confidence, times_seen, observation dates, detection and delisting state, network type, and provider status. Missing or invalid metadata is not treated as a clean lookup.
A positive observation count, at least 50% confidence, and usable recent observation data are required before a proxy, VPN, or Tor result affects Sentinel. Delisted, stale, zero-count, null, and low-confidence results are ignored.
Successful responses are cached for 3,600 seconds, volatile or delisted responses for 900. Failure caches range from 120 to 900 seconds; transport and server failures receive two bounded retries. Cache rows older than 24 hours are removed.
SCaptcha sends tag=0 by default. Administrators may opt in to provider-side positive-detection logs. The visitor's IP address is still sent for the lookup, and provider failure remains different from a clean result.

Local request analytics remain enabled by default. Logs may contain linkable operational data: time, result, URI, IP address, user agent, derived browser and device data, network and location fields, reasons, Sentinel data, and submitted browser telemetry.
Retention defaults to 90 days and is configurable from 1 to 3,650 days. Cleanup removes rows older than the cutoff but keeps rows exactly on it. Disabling analytics stops new collection; it does not delete existing rows or exports.

Behavioral scoring and Sentinel remain off by default. Audio, WebGL, animation-frame, and canvas routines run only when behavior checks and the respective option are enabled. Unsupported or privacy-restricted signals are neutral.
Generic Chromium/ANGLE, Mesa, and llvmpipe renderer strings no longer count as automation on their own. Pointer requirements apply only to mouse input, scrolling only to scrollable pages, and keyboard or touch activation does not need simulated mouse movement.

As of 8 September 2026, EDPB Guidelines 02/2026 on Anonymisation remain open for public feedback until 30 October 2026. They are not described here as final law or final guidance.
Chrome 153 was released on 8 September 2026 and began Chrome's documented two-week stable cycle. Browser compatibility must be checked on each release rather than inferred from this test run.