Real people in. Bad actors out.
- Role
- Co-founder
- Years
- 2026 — now
● Overview
After years on the automation side, we built the other side: a real-time bot detection and fraud platform. Bastion scores every request, links the signals behind every account, and catches the evasion techniques we know from experience.
● The hard part
Most bot mitigation keys off a handful of static checks that modern automation spoofs in an afternoon. Catching it means correlating device, network and behavior across sessions and noticing when the story doesn't add up.
- <1ms
- request scoring
- 50+
- signals per request
- 5
- language SDKs
● What I built
- 01
A Go scoring engine
Sub-millisecond request classification across 50+ signals on Fiber v3, with Redis and in-memory stores, rate limiting and adaptive proof-of-work challenges for suspicious sessions.
- 02
Fingerprint correlation
Canvas, WebGL, AudioContext and TLS fingerprints cross-checked for coherence. It flags fingerprint rotation, residential proxy chains and browser spoofing instead of trusting any one signal.
- 03
Behavior & network intelligence
Mouse dynamics, keystroke timing, scroll and touch patterns combined with proxy, VPN and Tor detection, ASN reputation and impossible-travel checks.
- 04
Identity graph & AI analyst
Cross-session clustering exposes fraud rings, and a self-hosted LLM analyst investigates accounts. A NestJS platform adds rules, Stripe billing and dashboards, with SDKs in Go, JS, Python, PHP and Ruby.
● Stack
- Go
- Fiber v3
- Redis
- NestJS
- Next.js
- PostgreSQL
- Python
- Ollama
- Stripe
- Docker