Prosopo is a privacy-focused, self-hosted CAPTCHA alternative that provides multiple challenge types—image selection, puzzle (image jigsaw), proof-of-work, and frictionless (behavioral bot detection). The system comprises an Express-based provider API (with MongoDB and Redis for persistence and caching), a CLI for administrative tasks, client-side embeddable widgets (vanilla JS bundle, React/Angular/Vue/Svelte wrappers), and a suite of supporting libraries for cryptography, locale, datasets, and native Rust modules (JA4 TLS fingerprinting, Merkle tree acceleration, puzzle rendering). Bot detection is multi-layered: client-side behavioral data (mouse/keyboard/touch events, SIMD readings) is collected and server-side scored, combined with JA4 TLS fingerprint analysis, IP reputation (ipapi.is + MaxMind), DNS asymmetry detection, spam email heuristics, and custom decision machines per site key. The architecture is a monorepo with ~70 workspaces, leveraging Vite for bundling, Vitest for unit/integration tests, and Cypress for E2E visual regression testing. The provider enforces access policies (allow/block/restrict) via a Redis-backed rules engine and maintains usage counters for rate limiting. Asset sealing (AES-256-GCM) protects image CDN URLs, and puzzle difficulty is sampled with a CSPRNG-stratified ladder to frustrate solver calibration.
hMailServer is a production-grade, open-source email server for Microsoft Windows, implementing SMTP, POP3, and IMAP protocols with comprehensive anti-spam (SPF, DKIM, DMARC, DNSBL, SURBL, greylisting, SpamAssassin) and anti-virus (ClamAV, ClamWin, custom) capabilities. The server core is written in C++ using Boost.Asio for asynchronous I/O and exposes a COM automation API for administration. It is complemented by a .NET WinForms Administrator GUI, a PHP-based web admin, and a suite of database upgrade scripts supporting MySQL, MSSQL, PostgreSQL, and SQL Server Compact Edition. The architecture follows a layered pattern: business objects (e.g., Account, Domain, Rule) with a generic Collection/Persistence layer, a caching subsystem with TTL-based eviction, and a plugin-style spam test runner. Key data flows include message reception via SMTP, anti-spam scanning, local or external delivery, and optional virus scanning. External dependencies include OpenSSL, Boost, and database client libraries. The codebase is well-structured with reusable patterns but shows signs of age (manual memory management, COM, .NET Framework 4.5, PHP without modern framework).