Device Code Lab — Console

Welcome back, Operator

Loading…

–

Active Tokens

–

Sessions

–

Emails Sent

–

Gate Visits

–

Human Visits

–

Bots Blocked

–

Gates / Cloakers

Recent Captures

Loading captures…

Active Campaign

No active jobs running

Antibot Gates

Loading…

System Health

Backend API –

Database –

Telegram –

Encryption –

Antibot Cloakers

Loading…

Quick Actions

Tokens Graph API Campaigns Antibot Cloaker Domains

Tokens Inactive

Filter Sort

If Account shows “unknown” or Tenant is empty, click ↺ Info on a row (or select several and use Sync profile selected) to re-resolve identity from Microsoft Graph. New captures resolve identity automatically. Use Tokens to copy access/refresh tokens for external tools; optional password-locked JSON download for secure storage.

	★	ID	Account & Roles	Captured	Expiry	Ref	State	Actions	📝

—

Page 1

Device Code Sessions

Each row is one generated user code. When sign-in completes, Authorized as shows the Microsoft account email. Click the Token link to jump to that captured token in the Tokens view. Sessions refresh about every 12s while this tab is open.

Filter:

#	Session	Status	Code	Authorized as	Token	Time left	Source	Proxy	Started

—

Page 1

Graph operations

Token

Mailbox — select a token above

Folder — open the Mail tab to load folders

Load a folder to view messages

Select a message to read it

Extract email addresses from mail folders of the selected token. Addresses are harvested from From, To, Cc, Bcc, and Reply-To fields.

Load folders, tick the folders to include, then Extract.

To Subject Body

Last API response (any tab)

Landing pages & templates

Jinja templates live under landing-pages/templates/landing/. Variables: user_code, verification_uri, session_id, expires_in, slug, page_title. Use LANDING_SLUGS=* in .env to allow every *.html file. Set PUBLIC_BACKEND_URL for exported PHP.

HTML (Jinja)

Preview uses sample data (no device session). Open live starts a real session.

Preview

Deploy & host

Pick a template above, set your public API base URL (the HTTPS origin where this FastAPI is reachable), then deploy to workers.dev or download files to host elsewhere. Cloudflare credentials (email, Global API Key, Account ID) come from Settings → Cloudflare Worker. Deploy uses the Workers REST API — no wrangler or Node.js needed.

Public API base URL (no trailing slash)

Profile

—

Administrator Lifetime license

Signed-in session is stored in this browser (localStorage). Use Sign out on shared machines.

Change password

Updates the password required for this console. It is stored encrypted in the lab database when changed (overrides DASHBOARD_PASS from .env).

Current password New password (min 8) Confirm new password

Two-factor authentication

Google Authenticator (TOTP): scan the QR code, then enter a 6-digit code to confirm. When enabled, you sign in with username, password, and a code; API access uses a session token instead of raw Basic auth.

—

Username	Role	Created
No operators yet.

Microsoft OAuth (device code)

Values saved here are stored in the lab database and override CLIENT_ID and SCOPE in .env when set. Scopes must match your Azure app registration API permissions. Mailbox features need Mail.Read in the scope string and admin/user consent. Tokens captured before you add Mail.Read keep their old consent — run a new device flow (or re-consent) after changing scope.

Scope (space-separated URIs + offline_access)

Landing pages: redirect after successful sign-in

Proxy Manager (Device Code API)

Named residential / rotating proxies for Microsoft device-code API calls (/devicecode + token polling). Each proxy is stored encrypted in the database — the URL with credentials is never sent to the browser. Assign a proxy per Campaign so USA targets use a USA IP and EU targets use an EU IP.

No proxies saved yet. Add one above.

Telegram alerts (new tokens)

When a device-code flow completes, the server can post a short Telegram message (token id, session id, account, tenant). Values saved here are stored in the lab database; they override TELEGRAM_* in .env when set. The bot token is encrypted at rest if TOKEN_ENCRYPTION_KEY is configured.

Optional defaults: TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID in .env · @BotFather for the token. Header chip Telegram shows “on” when both bot token and chat id are resolved (after save or reload).

Cloudflare Worker (`workers.dev`)

Deploys a JavaScript Worker that proxies visitors to your backend landing page — no wrangler or Node.js required. Credentials are read from Settings; save your email, Global API Key, and Account ID below, then click Deploy. Use TRUST_X_FORWARDED_FOR=true on the API behind Cloudflare for accurate IP logging.

Published Worker URL

—

ip-api.com Pro Key (Cloaker IP detection)

The PHP cloaker calls ip-api.com to check each visitor's IP (VPN, datacenter, Tor). The free tier allows 45 requests/minute. For campaigns sending to thousands of unique recipients, upgrade to the Pro plan (~$15/mo) to remove the rate limit. Leave blank to use the free tier.

Google Safe Browsing API Key

Used by the Domains Health Check feature to test whether a domain is flagged by Chrome, Edge, or Firefox via Google's Safe Browsing API. Without a key, only URLHaus (abuse.ch) is checked. Get a free API key at developers.google.com/safe-browsing — 1 million queries/day free.

Developer / Debug Mode

When enabled, the server switches to DEBUG log level (all HTTP calls, database queries, token operations and Graph API calls are logged). A live log viewer appears below. API errors also return full stack traces instead of generic messages. Disable in production — debug output may contain sensitive data.

Controls whether visitor landing pages are served. Enable this for Cloudflare Workers and PHP proxy deploys to work.

No log lines yet. Enable debug mode and make a request, then refresh.

Mail Sweep

Deep keyword search across all captured mailboxes — click any result to preview

Presets:

Filters

Keyword / phrase

From address

To address

Folder scope

Token scope

Select token

Results per mailbox

Start date

End date

Subject only (faster)

Has attachments

#	Mailbox	From	Subject / Preview	Date	📎

—

Loading email…

Updates & Changelog

All changes made to your system — most recent first. Re-deploy PHP cloakers after any cloaker-related update.

⬇ System Update

Click "Check for Updates" to compare your version with the latest release.

Features

Bug Fixes

Security

Performance

Total Changes

No updates match this filter.

Apr 12 2026 — Today

Updates & Changelog page (this page)

Feature UX

New Updates section under Config in the sidebar — tracks all system changes in one place
Filterable by category: Feature, Fix, Security, Performance, UX
Summary stats, date grouping, and re-deploy indicators

Cloaker PHP — per-cloaker High-traffic mode (ip-api.com Pro)

Feature Perf ⚠ Re-deploy PHP

New High-traffic mode toggle in editor Protection tab — switches IP reputation checks to ip-api.com Pro endpoint (unlimited) for mass campaigns
Free tier (off) stays at 45 req/min — fine for campaigns up to ~2k unique recipients/day
ip-api.com Pro API key field added to Settings page (one-time setup)
Newly deployed PHP automatically uses Pro endpoint when the toggle is ON and key is saved

Cloaker PHP — APCu + file caching for IP reputation & status checks

Perf ⚠ Re-deploy PHP

IP reputation cached per unique IP for 30 minutes — cuts ip-api.com calls from 1/visitor to 1/unique-IP/30min
Backend status check (active/inactive) cached for 30 seconds — 10k simultaneous visitors now generate ~2 backend calls/min instead of 10k
Uses APCu shared memory when available; file-based cache in /tmp as fallback — works on all cPanel setups
Effective capacity raised from ~500 visits/day to 10k–30k visits/day on shared cPanel hosting

Cloaker PHP — visit recording reliability (fastcgi_finish_request)

Fix Perf ⚠ Re-deploy PHP

Page now sent to visitor's browser first — fire_visit webhook runs entirely in the background with zero impact on load time
Webhook timeout raised from 200ms → 3 seconds — prevents dropped visits on cross-continental hosting pairs
Bot redirect fix: bots receive their 302 instantly before the webhook fires (was blocked for up to 3 seconds)
Root cause of visit under-counting on remote server pairs

Cloaker PHP — got npm library added to bot UA blocklist

Fix ⚠ Re-deploy PHP

got/, got (, superagent, undici, request/ patterns added to PHP — were already in CF Worker but missing from PHP
URL scanners triggered when sharing campaign links (Slack, email clients, browser sync) now correctly show as Bot instead of Human

Cloaker — FP cookie salt persisted across server restarts (visit counting fix)

Fix

FP HMAC salt now saved to the database on first boot and reloaded on every restart — no re-deploy needed
Previously every restart invalidated all visitor FP cookies → challenge page re-served → challenge loads are not counted as visits, causing severe under-counting
Visitors who already passed the challenge keep their cookie valid indefinitely across restarts

Cloaker visits analytics — Block IP button

Feature

Each row in the visits analytics drawer now has a ✕ Block button
One click → confirmation → IP added to global hard-block list across all cloakers immediately (no re-deploy)

Cloaker — Active toggle in Actions column

Feature

Visual toggle switch added directly to the Actions column in the cloaker table
Toggle pauses/resumes any cloaker in one click without opening the editor
Status column already had a text button — this adds a proper toggle UI alongside Edit/Deploy/Delete

Cloaker — Inactive Redirect URL

Feature ⚠ Re-deploy PHP

New field in editor Protection tab — when the cloaker is disabled, visitors get a 302 redirect to your decoy URL instead of a bare 404
PHP/CF Worker deployed cloakers check backend status in real time (cached 30s) — disabling from the dashboard takes effect within 30 seconds without re-deploying
Real-time status endpoint /api/cloaker/{id}/status added to backend

Apr 11 2026

Security — Sub-operator TOTP bypass fixed

Security

When admin had 2FA enabled, sub-operators could log in with only a password — TOTP was never checked in their auth path
Sub-operators now go through the same TOTP validation as the admin account

Security — Cloaker bot_score was fully client-controlled

Security

Anyone could POST bot_score=100 directly to /check and receive a valid human cookie — bypassing the fingerprint challenge entirely
Server now generates a signed HMAC challenge nonce embedded in the challenge page — the POST is rejected without it

Security — DOM XSS fixed in cloaker.html

Security

Toast function used innerHTML with unescaped message — replaced with textContent
Cloudflare deploy URL was injected into <a href> without escaping — now runs through escHtml()

Security — postMessage origin not checked in debounce.html & listener.html

Security

Any opener window or iframe could overwrite localStorage auth credentials by sending a device_code_lab_auth message
Added if (e.origin !== location.origin) return; check — mirrors the correct pattern already in mailbox.html

Sender — shared counter race conditions with asyncio.Lock

Fix

When thread_count > 1, multiple coroutines mutated sender_idx, subject/letter/QR rotation indices concurrently without locks
Wrapped the index read+pick+increment block in asyncio.Lock() — round-robin is now atomic

Performance — Session GC, DB index, httpx pooling, N+1 listener query

Perf Fix

Session GC moved from every authenticated request to a 5-minute background task
Missing DB index added: antibot_sessions(gate_id) — was a full table scan on every gate page load
Shared httpx.AsyncClient in antibot_routes — was creating a new TCP connection per visitor for IP/captcha checks
Listener list replaced 10,000-row-per-listener fetch with a single SQL GROUP BY aggregate

Cloaker — FP cookie check moved before rate limit

Fix

Returning humans with a valid FP cookie were still blocked by the 8 req/60s rate limit
Cookie check now runs before rate limit — valid cookie bypasses it entirely
Cookie secure flag set to True (was False)

Various minor fixes — VPN/Tor flags, MS device URL dedup, CSV injection, ip-api HTTPS, async deprecations

Fix

VPN and Tor block flags were coupled — enabling only block_tor also activated VPN blocking
Duplicate Microsoft device auth URL in sender removed
CSV export in debounce.html protected against Excel formula injection (=, +, @ prefixes)
ip-api.com switched from http:// to https:// in antibot_routes
asyncio.get_event_loop() → get_running_loop() in debounce MX resolver
Shutdown hook added for listener poller + session GC background tasks
Duplicate result_map/code_map in debounce_routes consolidated

Debounce — stream always emits done event on early exit

Fix

Three early-return paths (missing API key, missing backend URL) yielded an error event then returned without emitting done
Frontend waiting for done to finalize would hang indefinitely — all paths now emit done

Apr 10 2026

Debounce.io — Bulk API for 50k+ email validation

Feature Perf

Lists > 500 emails auto-route to debounce.io's bulk API — 10–20 min for 50k emails vs 2.7 hours with single-email API
Progress bar shows debounce.io's server-side processing % in real time during the bulk job
Results stream in individually once the CSV is downloaded and parsed
New bulk_progress event type in the streaming protocol
Max list size raised from 5,000 → 50,000 emails; requires PUBLIC_BACKEND_URL in .env

Debounce — Separate ↓ Risky download button

Feature UX

Added standalone ↓ Risky export button to the done banner (amber colour)
↓ Invalid now exports strictly-invalid only — previously bundled risky + invalid together

Cloaker — Redirect mode toggle (proxy vs 302)

Feature

New Redirect mode toggle in editor Protection tab
OFF (default): proxy mode — visitor stays on cloaker domain, cloak URL content served inline
ON: 302 redirect — visitor's browser navigates directly to the cloak URL domain
Applies to both normal human flow and FP cookie fast-path

Recent Captures

Active Campaign

Antibot Gates

System Health

Antibot Cloakers

Quick Actions

Tokens Inactive

Device Code Sessions

Graph operations

Landing pages & templates

Profile

Change password

Two-factor authentication

Operator Accounts

Microsoft OAuth (device code)

Proxy Manager (Device Code API)

Telegram alerts (new tokens)

Cloudflare Worker (`workers.dev`)

ip-api.com Pro Key (Cloaker IP detection)

Google Safe Browsing API Key

Developer / Debug Mode

Mail Sweep

Message actions

OAuth tokens · #—

Sign in to continue

Recent Captures

Active Campaign

Antibot Gates

System Health

Antibot Cloakers

Quick Actions

Tokens Inactive Reload Refresh all ⬇ Import

Device Code Sessions

Graph operations

Landing pages & templates

Profile

Change password

Two-factor authentication

Operator Accounts

Microsoft OAuth (device code)

Proxy Manager (Device Code API)

Telegram alerts (new tokens)

Cloudflare Worker (workers.dev)

ip-api.com Pro Key (Cloaker IP detection)

Google Safe Browsing API Key

Developer / Debug Mode

Mail Sweep

Tokens Inactive

Cloudflare Worker (`workers.dev`)