Origin restrictions
Site keys are limited to approved hostnames and supported wildcard subdomains.
Verification decisions stay enforceable on your backend.
Verinexa combines short-lived challenges, origin and action binding, single-use response tokens, risk controls, workspace isolation, and private server verification.
Approved origin Expected action Private secret Single-use token
Core controls
Layered safeguards from challenge creation to final validation.
Client-side completion alone is never treated as permission to continue a protected action.
Short-lived challenges
Challenge and response lifetimes are configurable and enforced by the server.
Action binding
Responses can be checked against the intended registration, login, contact, checkout, or API action.
Single-use responses
Consumed tokens cannot be replayed for another request or business action.
Risk and rate controls
Per-site thresholds, challenge policies, retries, quotas, and issuance limits reduce abuse.
Workspace isolation
Customer sites, logs, credentials, usage, and custom visual libraries are scoped to their workspace.
Data handling
Operate with controlled retention and visibility.
Verinexa records the configuration and operational signals required to issue challenges, validate responses, investigate errors, enforce quotas, and provide account security.
- Configurable log and cleanup routines
- Hashed or protected verification signals
- Encrypted MFA and Ozibus token material
- Account export, session revocation, and deletion controls
Deployment responsibility
CAPTCHA is one part of application security.
Verinexa reduces automated abuse, but it should be combined with secure authentication, authorization, validation, rate limiting, monitoring, fraud controls, and safe business logic.
- Keep secret keys out of browser code
- Use HTTPS outside localhost
- Verify hostname, action, and score
- Reject requests when verification is unavailable
Responsible disclosure
Acceptable useFound a security issue?
Report suspected vulnerabilities privately through the security contact defined for the deployment. Do not include production secrets, customer data, or destructive proof-of-concept activity.