fraud — the form below is real, and so is everything it reports

Fraud watches a form being filled in and tells an operator which submissions deserve a human look. It advises; it never blocks a sale and it never auto-rejects. This page is a seller's page: it loads the collector from the deployed service, that collector mints a session, reports what it observes, and posts a snapshot of this page when you submit — and the panels beside the form show you exactly what went over the wire.

The page’s own health check, and what it is honestly able to say

The one thing this page cannot show you, and will not pretend to

Try to break it — live, against the real deployment

Each button sends a request the service is designed to refuse and shows you the refusal it actually returned. Nothing is simulated. Nothing reaches a table.

$ curl -s -w '\n# HTTP %{http_code}\n' \
    https://fraud.lrs.amtechhq.com/collect/9ef8f80a29b60bfed257d0cfd323fc9c/score
404 page not found
# HTTP 404

$ curl -s https://fraud.lrs.amtechhq.com/api/v1/console/overview
{"success":false,"errors":["invalid service credential"],"meta":{"timestamp":"2026-09-06T17:54:42Z"}}
$ # HTTP 401

The recording policy for this campaign — live

Not read. This panel makes the request from your browser; with JavaScript off it is not made, and nothing here is filled in from anywhere else.

The collector itself

The script is fixed, reviewed source, embedded in the service binary and served at a stable path. It is never generated, never templated and never concatenated with rule data. Everything per-campaign arrives as JSON in a block the script parses:

<script type="application/json" id="lrs-fraud-manifest">
{"endpoint":"https://fraud.lrs.amtechhq.com","campaign_key":"example-site","signals":[…]}
</script>
<script src="https://fraud.lrs.amtechhq.com/collect/collector.js" defer></script>

Rule names, signal names and condition values are text an operator typed into a console. Splicing them into JavaScript would make the rules table a code-execution surface on every seller's page, so they never enter the script — they arrive as data, and Go's JSON encoder turns < and > into escapes, so a campaign key containing </script> cannot close the block.

The fifteen signals — from source: cmd/fraud/assets/collector.js

The four at the bottom are sent on submit and on pagehide, never at load. Legacy computed its behavioural checks during page load, before any interaction had happened, so every one of them was structurally dead and its mouse check flagged all desktop traffic. A counter read before the visitor has done anything is not a measurement.

A probe that throws contributes nothing rather than a false. Could not look and looked and found nothing are different facts, and the service records them differently.

What else went over the wire, and what deliberately did not

The interaction stream

Typed events with millisecond offsets from one origin, the field they were on, and how many characters that field held: pointerdown, keydown, input, change, focus, blur, paste, copy, scroll, submit. Batched, and idempotent per (session, sequence), so a flush that may or may not have arrived can simply be sent again.

It does not capture keystrokes. The keydown handler has e.key in its hand and does not read it; there is no field on the wire that could carry it and no column behind it. Legacy recorded the actual character for every single-character key and kept it forever, so anything typed into a captured field was reconstructible character by character out of the database. The behavioural value is entirely in the type, the timing and the length — those travel, the content does not, and the column that would hold it does not exist, which is a stronger statement than a policy saying not to write to it.

Legacy's mousemove is deliberately absent. It was that system's highest-volume event and the cheapest of all of them to synthesise.

The DOM snapshot

Taken at submit, and the sensitive one, because it carries the values somebody typed. Built entirely in this browser: scripts removed, every URL-bearing attribute moved to an inert data-lrs-* attribute, every CSS url() defused, and every readable stylesheet inlined. A cross-origin stylesheet throws on .cssRules and is skipped — which is precisely where a replay renders degraded, and that degradation is the feature, because the alternative is the server retrieving a URL on a stranger's say-so.

Over the size ceiling it is not sent at all. Truncated markup is a lie about what the page looked like, not a smaller snapshot.

Retention, which is the reason any of this is storable

Three windows, and they are deliberately not one number: recordings and page snapshots at 7 days, signals and the interaction stream at 30, the score receipt at 365. Expiry is a sweep that DELETEs on a timer, never a read-time filter — a filter leaves the rows on disk and calls them deleted. The system this replaces held 670,389 rows of captured page content and 93,799 form sessions going back 290 days, with no retention limit, because nothing was ever configured to delete it and no row existed to say what the answer should have been.

Verify any of it yourself — recorded 2026-09-06

$ curl -s -X POST -H 'Content-Type: application/json' -d '{}' \
    https://fraud.lrs.amtechhq.com/collect/example-site/session
{"session_key":"9ef8f80a29b60bfed257d0cfd323fc9c"}   # HTTP 201

$ curl -s https://fraud.lrs.amtechhq.com/collect/example-site/recording-policy
{"screen":{"mode":"off"},"webcam":{"mode":"off"}}

$ K=9ef8f80a29b60bfed257d0cfd323fc9c
$ curl -s -o /dev/null -w '%{http_code}\n' -X POST -H 'Content-Type: application/json' \
    -d '{"signals":[{"name":"js_enabled","value":"true","observed_at":"2026-09-06T17:55:00Z"}]}' \
    https://fraud.lrs.amtechhq.com/collect/$K/signals
204

$ curl -s -X POST -H 'Content-Type: application/json' \
    -d '{"signals":[{"name":"is_fraud","value":"0","observed_at":"2026-09-06T17:55:00Z"}]}' \
    https://fraud.lrs.amtechhq.com/collect/$K/signals
{"error":"this boundary records observations only: is_fraud is not something a client may report"}
# HTTP 422

$ curl -s -X POST -H 'Content-Type: application/json' \
    -d '{"document_html":"<html></html>","document_url":"http://169.254.169.254/",
         "viewport_width":1,"viewport_height":1,"captured_at":"2026-09-06T17:55:00Z"}' \
    https://fraud.lrs.amtechhq.com/collect/$K/snapshot
{"error":"a JSON body with document_html, viewport_width, viewport_height and captured_at is
  required, and it may carry nothing else"}
# HTTP 400

What is behind the credential, in full

Everything below needs Authorization: Bearer <service key>, which this page does not have and must never have. Listed so you can see the size of what is not on this page:

• Scores, verdicts and the threshold in force — /api/v1/sessions/{key}/score, /console/settings
• The console overview: sessions total, clear, review, unscored, rules active and archived
• The rules themselves, and the integration screen that names every active rule whose signal the collector cannot produce
• Replay: the stored markup, the interaction stream and the recording bytes, each through the sharing intersection and then the masking policy, in that order
• The sharing policies, the campaign-to-seller mapping, and the share links — every one of which resolves at view time, so tightening a policy narrows links already in a buyer's inbox
• The retention policy and its dry run, which is the actual sweep with the deleting turned off rather than a second estimate
• The masking policy, which starts empty on purpose: masking is for a viewer with no claim on the value, and the buyer who purchased the lead is not one
• Attaching a session to a lead — deliberately not on the public boundary, because a browser-reachable route that could attach a lead key would let anybody who could guess one point it at a session they controlled