Status Dashboard Docs

What's New

Latest updates, improvements, and fixes across the GarudaShield network.

Current: v2.2.0 Node: edge-ny2
v2.2.0 Latest August 24, 2026

Cookie token management, dashboard improvements, and status page redesign.

Added
  • Cookie token on/off per domain — new dashboard tab lets you disable persistent access cookies for any protected host. When off, visitors must re-verify on every request.
  • Cookie token API — GET /api/access/cookietokens, POST /api/access/cookietoken/toggle, and POST /api/access/cookietoken/toggleall for managing cookie token state programmatically.
  • Status page redesign — completely rebuilt with a single clean design system. Removed duplicate CSS variable layers, fixed broken base64 stylesheet link, corrected Unicode rendering issues.
Changed
  • Access gate now checks per-domain cookie token setting before issuing or rotating the gs_access cookie.
  • Dashboard sidebar injection system for adding custom management pages without rebuilding the React SPA.
Fixed
  • Status page Unicode characters (…, –, ·, ✓) were rendering as mojibake due to encoding issues in the V2 CSS overlay.
  • Broken <link> tag with placeholder base64 data causing console parse errors on the status page.
v2.1.0 August 12, 2026

Dashboard overhaul, cluster sync, fortress mode, and multi-site access control.

Added
  • Fortress mode — autonomous auto-hardening defense that escalates protection levels based on sustained attack intensity. Four levels from watch to lockdown.
  • Multi-node cluster sync — real-time block/whitelist replication between edge nodes. New edge-ny1 and edge-ny2 nodes with automatic peer discovery.
  • Per-domain access gate — each protected host can be independently toggled on or off. Global protect-all default with per-host overrides persisted in shield-config.json.
  • Private paths — IP-restricted path prefixes with auto-blocking for unauthorized access attempts. Replicates blocks across the cluster.
  • Command palette (Ctrl+K) — keyboard-driven navigation across all dashboard pages and quick actions.
  • Geo map page — live threat visualization showing attacker origins and traffic distribution.
  • Event log — searchable timeline of security events with filtering by type and severity.
  • Notification system — visitor login tracking, failed attempt logging, and access activity history with Discord/Telegram webhook support.
Improved
  • Dashboard responsive design with mobile hamburger menu and touch-friendly tap states.
  • CAPTCHA generation quality — better glyph rendering, decoy characters, and gradient backgrounds for improved bot resistance.
  • Rate limiter adaptive tuning with RED (Random Early Detection) and token bucket refinement.
  • TLS fingerprinting with updated JA3 database and headless browser detection patterns.
Fixed
  • CAPTCHA timing attack — added minimum submission time check to prevent instant-form bots.
  • Cookie domain derivation for domains with fewer than 4 labels (e.g. fluxnet.cfd).
  • SSE reconnection loop when the dashboard API is temporarily unreachable.
Security
  • Cluster token secret is now configurable per-node or shared. Dashboard warns when nodes use mismatched secrets.
  • Private path IP validation with CIDR range support and automatic block propagation.
v2.0.0 July 28, 2026

Major rewrite with multi-layer defense engine, reputation scoring, and real-time dashboard.

Added
  • 7-layer defense pipeline — Layer 4 SYN/bogon filtering, rate limiting with sliding window + token bucket, TLS fingerprinting, Layer 7 validation, WAF with signature modules, anomaly detection, and reputation scoring.
  • Reputation engine — persistent IP scoring with decay, subnet influence, ASN tiering, and automatic block/challenge thresholds.
  • Anomaly detector — Z-score RPS monitoring, path spike detection, payload entropy analysis, and protocol anomaly detection.
  • WAF modules — SQL injection, XSS, path traversal, command injection, LFI, RFI, shellshock, and scanner detection with custom rule support.
  • Adaptive rate limiting — auto-tuning based on traffic patterns with RED queue management and connection-per-IP limits.
  • Real-time dashboard — SSE-powered live metrics, threat timeline, traffic analysis, and defense status overview.
  • JS challenge & proof-of-work — browser verification challenges with configurable difficulty and token rotation.
Changed
  • Complete architecture rewrite from single-file shield to modular engine with pluggable defense layers.
  • Config system moved from JSON files to JavaScript modules with environment-specific overrides.
  • Logging switched to structured JSON format with file rotation and level filtering.
Security
  • All token signing now uses HMAC-SHA256 with per-boot random secrets.
  • Timing-safe comparison for all token and password verification.
  • Config secrets are never logged or exposed in API responses.
v1.2.0 June 15, 2026

Access control, alert webhooks, and edge node improvements.

Added
  • Access gate with CAPTCHA — first-time visitor verification with SVG captcha, rate limiting, and persistent cookie tokens.
  • Alert webhooks — Discord and Telegram notifications for high-severity events with configurable cooldowns.
  • Edge HTTP server — multi-host reverse proxy with static site serving, upstream routing, and SSL termination.
Improved
  • Bloom filter performance for IP blocklist lookups — 3x faster at 100k entries.
  • Graceful shutdown handling with PM2 integration and process uptime tracking.
v1.0.0 May 20, 2026

Initial release of GarudaShield.

Added
  • Core DDoS protection engine with HTTP request analysis, IP blocking, and rate limiting.
  • Basic dashboard with real-time metrics and block/whitelist management.
  • GeoIP lookup for traffic origin analysis and country-level filtering.