Against the stack
Every control has a price. Who pays when it is wrong?
Chitmark is not bot detection. CAPTCHAs and fingerprints ask whether traffic looks automated; Chitmark asks whether a costly action should proceed, and learns from what happens after. Rate limiting vs fraud prevention is the wrong binary if you only cap volume. Ask three things instead: who pays when a decision is wrong, what it costs your real users, and whether the next decision learns from this one. Here is the scorecard for free-tier signup abuse.
| Approach | Stops farms? | The agent story | Who really pays | Learns from outcomes? |
|---|---|---|---|---|
Manual rate limits | Slows a single box; a distributed farm spreads under every threshold | Agents pace themselves and rotate identities | Your heaviest legitimate users hit limits first | No record of what a blocked action would have cost |
CAPTCHAs | Solver services clear them for fractions of a cent | Headless browsers solve vision and audio challenges | Every real user pays seconds and rage-taps | Nothing: pass or fail, no outcome joins back |
Device fingerprinting | An arms race; farms rotate stacks faster than vendors patch | Fresh browser profiles are cheap and plentiful | Privacy-heavy: the strictest regulators watch this closest | Signals only: no tie to what the signup was worth |
Email verification | Disposable inboxes are free at any quantity | Fully automated, including the confirmation click | A second inbox hop for your best users | Confirmed is not the same as valuable |
Stripe Radar | Scores signups for multi-account abuse with no card required, predicts nonpayment mid-cycle; real power, but Stripe documents these signals as advisory and fail-open | Evaluations anchor on payment methods and Customer objects; the pre-card moment, a fresh signup or a first quota grant, stays invisible | A score can block quietly; the trial control still leans on card-on-file friction for everyone who starts a trial | You can report outcomes back; the labels and the network they sharpen stay with Stripe |
Agent gateway guardrails | Caps what an approved agent can spend inside one gateway; the farm hits your signup form first | Governs agents you already let in; silent on who is at the door | None: configuration, not friction | Budgets and allowlists; no outcome joins back to the signup |
Chitmark | Every uncertain signup pays a challenge: compute or card, before touching credits | Legitimate agents clear proof-of-work invisibly and get a signed receipt | Near zero: a human's browser pays ~50 ms once, no puzzles | Every outcome (converted, credit burn, chargeback) tunes the next decision |
See for yourself
The playground runs real production decisions on a customer payload and a farm payload. The status page publishes the latency targets we hold ourselves to.