What is built — and what is not

This page is the cross-check on everything else on skriza.com. It lists each component with its actual state and evidence someone could go and verify. Where something is missing, it says so — that is the point of the page. A claim that does not survive one question is worse than no claim.

Skriza Shield — bot protection

The most mature part. It replaces Google reCAPTCHA and embeds on other people's sites.

  • Proof-of-work verification

    running

    A memory-hard computation in the browser instead of an image puzzle. IP addresses only as an HMAC hash, never in the clear.

    Checkable: 12 modules with their own tests, 8 API routes, publicly reachable at captcha.skriza.com

  • Risk engine

    running

    Scores client signals, IP reputation and threat feeds, then decides: pass invisibly, challenge, or block.

    Checkable: Thresholds configurable per customer site (0–4); decisions are recorded

  • Accessible alternative

    running

    Anyone who cannot see or operate the rotate task solves a pure computation instead.

    Checkable: Keyboard-operable; a non-visual path with no audio riddle

  • Third-party embedding

    running

    Widget plus server-side verification, with a Turnstile-compatible interface shape.

    Checkable: 5 SDKs in the repository: Go, PHP, Python, React, Vue

Platform

  • Feed ranking

    running

    The public feed is ordered by published principles: replies count for more than likes, views count zero.

    Checkable: Principles and the ordering of weights at /ranking; anti-abuse thresholds deliberately withheld

  • Reporting and moderation

    partial

    Report with a reason, a queue for review, remove or dismiss.

    Checkable: Reporting and the queue run; a person reviews. No automated detection, no notification back to the reporter

  • GDPR self-service

    running

    Data export as JSON and permanent account deletion, both in settings.

    Checkable: Deletion removes the account with its posts and messages — no deactivation flag

  • Messages, rooms, media

    running

    Real-time direct messages, live audio and video, image and video upload with transcoding.

    Checkable: 6 background jobs, self-operated LiveKit and S3-compatible storage

  • Developer platform

    running

    API keys with scopes, usage metering, management of Shield sites.

    Checkable: Keys authenticate against a real endpoint; calls are counted hourly

What does not hold yet

These are the things that read as finished elsewhere. They are not.

  • Our own measurement instead of Google Analytics

    partial

    First-party analytics with no plaintext IP, on our own servers.

    Checkable: Our own collection runs and hashes IPs; Google Analytics via Cloudflare Zaraz still runs alongside it

  • Our own recommendation and moderation models

    being built

    Models built in-house instead of off-the-shelf ones from outside Europe.

    Checkable: The rule-based ranking runs. There is no learned model

  • Coordinated-voting detection

    partial

    Accounts boosting each other lose weight — measured on how balanced and how concentrated the exchange is.

    Checkable: Running for pairs, a substantial discount. Rings of three or more accounts are not detected yet

  • Verified institutions

    planned

    Universities and public bodies prove who they are; credentials become cryptographically checkable.

    Checkable: Not implemented. Accounts are verified by hand today

  • Age assurance and parental controls

    planned

    The precondition for admitting minors at all.

    Checkable: Not implemented. That is why the platform is closed

  • Our own delivery instead of Cloudflare

    planned

    Attack protection and delivery on European nodes.

    Checkable: A US CDN currently sits in front of the site; stated in the privacy notice

How to read this

Skriza is in closed beta. The numbers on this page are counted from the source, not estimated: 279 automated tests, 50 data models, 5 SDKs.

Shield is usable and already embeds outside Skriza. The platform itself is not there yet: moderation, age assurance and the in-house models are missing, and we do not open without them.

To check any of it: the Shield challenge can be triggered at captcha.skriza.com, the feed formula is at /ranking, and what Shield processes is in its own privacy notice. If anyone finds a contradiction between this page and what the platform does, that is a bug we want to hear about.