Promo Abuse

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Pass the hashed account id, never a raw email or user id.
  // The callback hands you the requestID to correlate with the score.
  mod.checkAuthenticatedUser('8a9f-hashed-account-id', (ip, requestID) => {
    document.getElementById('shield-request-id').value = requestID;
  });
</script>

<form method="POST" action="/api/redeem">
  <input type="hidden" id="shield-request-id" name="shieldRequestId" />
  <input type="text" name="couponCode" placeholder="Coupon code" />
  <button type="submit">Apply reward</button>
</form>

app.post('/api/redeem', async (req, res) => {
  const { accountId, couponCode, shieldRequestId } = req.body;

  // 1. Your normal redemption checks first (code valid, not already used by
  //    this account, within campaign window).
  if (!(await couponIsRedeemable(couponCode, accountId))) {
    return res.status(409).json({ error: 'Coupon not redeemable' });
  }

  // 2. Look up the ShieldLabs Risk Score for this session.
  const shield = await waitForScore(shieldRequestId, 2000);
  const score = shield?.score ?? 0;        // 0-100, default to 0 if not yet in
  const signals = shield?.signals ?? [];   // explainable: [{ name, weight }]

  // Use the stable detection_flags to tell WHICH signal fired — a 30 from one
  // signal is not a 30 from another. These masking signals are innocent in
  // isolation, so weigh them against the device account-count below.
  const flags  = shield?.detection_flags ?? {};
  const masked = flags.vpn || flags.proxy || flags.tor || flags.private_relay
    || flags.browser_vpn_proxy || flags.anti_detect_browser || flags.datacenter_ip;

  // 3. YOUR code owns the verdict. Branch on the band, never on a label string.
  if (score >= 60 || masked) {
    // High band: strong anonymity signals on the redeeming session.
    // Hold the reward and require verification before granting it.
    return res.status(200).json({ requireVerification: true, reason: 'anonymity' });
  }

  // Clean / Low / Medium: carry on to the account-count check next.
  return grantOrGate(req, res, shield);
});

curl "https://account.shieldlabs.ai/api/v1/history/device_id/5eb7fd5c-1c5e-4a9f-9b21-7d2e8c0a1234?limit=50" \
  -H "Authorization: Bearer sec_your_private_api_key"

// Prefer the pre-computed pattern export as a fast denylist, and reserve live
// device_id reads for the borderline redemptions that are worth the cost.
const flaggedDevices = await loadFlaggedDeviceIds(); // from dashboard export

async function accountsBehindDevice(deviceId) {
  const rows = await shieldHistory('device_id', deviceId, 100);
  // Distinct hashed accounts seen on this one machine.
  return new Set(rows.map((r) => r.user_hid).filter(Boolean)).size;
}

async function grantOrGate(req, res, shield) {
  const deviceId = shield?.device_id;

  // The all-zero DeviceID is "no device", not a clean new one. A blocked or
  // JS-disabled browser returns it with a score of 90 or higher — a farm that
  // strips JS would slip the device count, so hold it on the score alone.
  const NIL = '00000000-0000-0000-0000-000000000000';
  const usableDevice = deviceId && deviceId !== NIL;
  if (!usableDevice) {
    return res.status(200).json({ requireVerification: true, reason: 'no_device' });
  }

  // Known farm device from the pattern export: hold the reward.
  if (flaggedDevices.has(deviceId)) {
    return res.status(200).json({ requireVerification: true, reason: 'device_linked_to_many_accounts' });
  }

  // Live count for this redemption. YOUR_ACCOUNT_LIMIT is your policy.
  if ((await accountsBehindDevice(deviceId)) >= YOUR_ACCOUNT_LIMIT) {
    return res.status(200).json({ requireVerification: true, reason: 'reward_already_claimed_on_device' });
  }

  // Clear: grant the reward.
  return grantReward(req, res);
}