Changelog

All notable changes to TRACIO are documented here. Versions follow semantic versioning (major.minor.patch).

v2.0.0 — V3 Tiered Visitor ID, 300+ Signals, Production Ready

Released: March 2026

This is a major release introducing the V3 tiered hashing system, expanding signal collection to 300+ signals, and achieving production-ready status after a comprehensive audit.

New Features

• V3 Tiered Visitor ID: New three-tier hashing system with independent Tier 1 (frozen hardware, 20 chars), Tier 2 (semi-stable browser, 10 chars), and Tier 3 (volatile context, 10 chars) producing 40-character base62 visitor IDs
• 300+ signals: Expanded from 70 to 300+ total signals (FingerprintJS Pro v4 signal coverage plus custom extensions and proprietary signals)
• Signal parity: Achieved full match coverage against FingerprintJS Pro v4 in automated Playwright comparison tests
• AI confidence scoring: Signal frequency weighting (IDF-based) and fuzzy matching using bit-level Hamming distance for returning visitor identification
• Admin dashboard: Real-time metrics, API key management, and ClickHouse analytics

Collection Improvements

• Collection reworked to run in parallel and off the main thread where the browser allows it, cutting the time to a result
• Better resilience on iOS, where the platform suspends parts of the collection until the page is visible
• Broader detection of extension-based and prototype-level spoofing, so tampered values no longer pass as genuine
• More stable behavior on hardened browsers: unavailable checks degrade confidence instead of failing the identification

Server-Side Improvements

• VPN detection consolidated into the single boolean network.vpn on webhook payloads
• Proxy detection with residential/datacenter classification — surfaced as network.proxy / network.datacenter
• Tor exit-node detection — surfaced as network.tor

Advanced Detection (Phase 4)

• Threat intelligence feeds integrated into the server-side risk assessment
• Behavioral analysis of pointer, keyboard, and scroll dynamics as evidence of human presence
• Cross-version normalization so browser upgrades no longer shift a returning visitor's identity
• Replay detection via request deduplication and timing analysis
• Detection of per-session randomization used by privacy-hardened browsers
• Consistency checks between what the client declares and how the connection actually behaves

Bug Fixes (50+)

Accuracy and stability fixes across identification and detection, including first-visit confidence floors, incognito correlation, cookie-match confidence, platform detection fixups on iPadOS, and a range of transport-level consistency checks.

---

v1.5.0 — Smart Signals and Bot Detection

Released: February 2026

New Features

• Smart Signals: server-side enrichment including VPN, proxy, Tor, datacenter, browser tampering, and suspect score
• Bot Detection Engine: multiple independent detectors covering Selenium, Puppeteer, Playwright, PhantomJS, headless browsers, and behavioral analysis
• Good bot allowlisting: 22 good bot types, each verified against the connecting IP rather than trusting the user-agent
• IP intelligence: VPN, residential proxy, and Tor exit-node classification
• Velocity tracking: per-IP and per-visitor activity tracking

Server-Side

• Emulator detection
• Privacy browser detection (Tor, Brave, Firefox ETP, Safari ITP)
• Suspect score computation (category-based, 0-100 scale)
• Improved headless classification, requiring corroborating evidence to reduce false positives
• Automation framework classification (Puppeteer, Playwright, Cypress, Selenium)

Client-Side

• Broader automation-framework coverage in the browser agent
• Detection of automation that patches the main frame but leaves other contexts untouched
• Integrity checks that catch instrumented and proxied browser APIs
• DevTools detection (Business and Enterprise plans)

---

v1.0.0 — Initial Release

Released: January 2026

Features

• 70 browser signals: canvas, WebGL, audio, fonts, navigator, screen, storage, CSS media queries
• Visitor identification: server-side hashing of the collected signals
• Compressed, obfuscated transport between the browser agent and the edge
• Cookie persistence: first-party cookie holding an opaque visitor UID (365-day expiry)
• GeoIP integration: MaxMind GeoIP2 for city-level geolocation
• Webhook delivery: Real-time event notification with retry and signature verification
• Managed cloud: fully hosted edge, storage, and dashboard — no infrastructure to run

Client SDK

• Tracio.init() initialization with public key configuration
• tracio.getResult() with tag and linkedId options
• Typed error handling with error code classification
• Lightweight minified bundle
• Browser compatibility: Chrome 57+, Firefox 52+, Safari 11.1+, Edge 79+

API

• Real-time webhook delivery with HMAC signatures and retries
• Workspace-scoped dashboard/management API (Clerk-authenticated, RBAC)
• Rate-limited edge ingest with CORS + credentials support

---

Upgrade Guide

v1.x to v2.0

The v2.0 upgrade introduces a new visitor ID format (V3 tiered hash). Existing visitor IDs will be recomputed. This means:

1. All visitors appear "new" in the database after upgrade
2. Confidence scores will be lower for 24-48 hours as the database rebuilds
3. linkedId continuity is preserved (your business identifiers remain)

The upgrade is rolled out automatically on the managed cloud — there is nothing to deploy on your side. No client-side SDK changes are required; the client protocol is backward compatible.