> ## Documentation Index > Fetch the complete documentation index at: https://docs.shieldlabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > Latest ShieldLabs changes: new and updated signals, API and webhook changes, and documentation improvements. What changed across the ShieldLabs platform and these docs. Newest first. ## June 2026 ### Documentation rebuilt from the production codebase The developer docs were rewritten end to end to match exactly what ships in production. The previous docs described features and a score range that the product does not have. If you integrated against the old pages, review the highlights below. The score is the **Risk Score**, a value from **0 to 100**. There is no "Trust Score" and no 0 to 999 scale. There is no in-product rules engine: ShieldLabs returns a score and the signals behind it, and your own code decides whether to allow, challenge, review, or block. **What the rebuilt docs now cover accurately:** Explainable score with a `Details` array. Every entry is the signal that fired and the points it contributed. Bands: Clean (0 to 9), Low (10 to 29), Medium (30 to 59), High (60 to 100). One signed webhook envelope per identification — `event_type` plus a `data` object (`request_id`, `risk_score`, `signals`, `observed_at`, and the rest). Waits up to 60s for an optional follow-up network check, then always delivers. Signed with `X-Shield-Signature` on the raw body, keyed per endpoint with `whsec_…`. At-most-once delivery — make handlers idempotent on `request_id`. Relationship patterns computed server-side and surfaced on the dashboard Patterns tab as Suspicious or Dangerous detections. An entity below the Suspicious threshold simply is not flagged. They are separate from the per-request scoring signals. Estimated unique Visitors and New Visitors counted by a fingerprint-derived identity, plus Traffic Sources that rank each channel by the anonymous-traffic share it delivers. Read past results with the History API and fetch your domain profile. Server-side auth uses an `Authorization: Bearer` token with the `X-Shield-Domain` header. DeviceID, VisitorID, CookieID, SessionID, RequestID, and the UserHID you pass in (hash it yourself before passing it). DeviceID is durable because it is derived from the browser environment, not stored. **Corrections from the previous docs:** * Only four band labels exist: **Clean, Low, Medium, High**. There is no "Bot" or "Banned" band. * The dashboard feature is the **Patterns** catalog, not "Behavior Patterns" or a "velocity" pattern. * 999 is an internal rate-limit sentinel, never a customer Risk Score. New to the platform? Start with the [Quickstart](/quickstart), then read [How it works](/overview) and [Acting on the Risk Score](/guides/acting-on-risk-score).