[htl-syterme]

I've been dealing with bot abuse on a side project where bots were hitting our API endpoints and burning through our free tier budget. Didn't want to add a captcha because it kills signups. Built a small open standard called X-Trust that reads a signed header and annotates the request with a human score.

It works as Express middleware in 3 lines. The client SDK measures keystroke timing and touch entropy, signs a score with HMAC-SHA256, attaches it as an X-Trust header. The server verifies the signature. Tokens expire in 120 seconds so replay attacks don't work.

This PR adds a documentation page showing how to use it with Express. It never blocks requests — just annotates them with a trust score so the app decides what to do.

OSS spec and live endpoint: https://github.com/htl-syterme/htl-core

[netlify]

✅ Deploy Preview for expressjscom-preview ready!

Name	Link
🔨 Latest commit	05d60a0
🔍 Latest deploy log	https://app.netlify.com/projects/expressjscom-preview/deploys/6aa6e8bff800c800082a6bcc
😎 Deploy Preview	https://deploy-preview-2514--expressjscom-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 98 (🟢 up 1 from production) Accessibility: 100 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 80 (no change from production) View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[krzysdz]

We currently don't add middleware recommendations, because we have no requirements specifying what could be added. For earlier examples of similar requests and discussions see:

• Add express-joi-validations to community middlewares #1516 (comment)
• docs: add pompelmi to additional middleware modules #2227 (review)
• docs(middleware): add @inferdi/express #2375 (comment)
• Request to add an express middleware #966 (comment)
• Add the casbin-express-authz middleware to provide better authorization #981 (comment)
• Add express-slick-css to middleware.md #968 (comment)
• Establish criteria and process to review middleware listed on the site #988

Your account and the middleware are new (20 days old), the middleware looks is vibe coded, has 5 downloads in the last week from NPM, is paid (in crypto only!)¹ and you "market it" heavily and in rather suspicious way, so if there were any guidelines on middleware that may be featured on the Express website, this probably wouldn't satisfy them. By the way, the docs/ directory is not even a part of the website.

Footnotes

1. There's also no information who the seller is, no terms of service, no nothing and the process may be illegal - I assume that there won't be an invoice either? ↩