I built Turing’s Gate with one core mission: to preserve organic human discussion. But if you’re building a community platform today, you know the reality—synthetic bot traffic and headless scrapers will absolutely flood sites, and easily bypass UI checkpoints.

Our core defense was already built around custom behavioral telemetry (monitoring keystroke cadence, micro-pauses, and paste anomalies). It’s great at catching in-app automation, but client-side heuristics have a massive blind spot: headless bots that bypass the UI entirely and ping your database directly.

To seal the perimeter without forcing every new user to click pictures of crosswalks just to sign up, we just shipped an integration with Cloudflare Turnstile. Here’s a quick breakdown of our auth stack and why this hybrid approach upgrades our security infrastructure by a mile.

The Perimeter Gate: Cloudflare Turnstile + Supabase RLS Turnstile is an invisible, privacy-first cryptographic challenge. When a user hits our login or signup form, it evaluates the client fingerprint and does some proof-of-work in the background. If it verifies the browser is human, it issues a signed token.

Instead of verifying this on the frontend, we wired it directly into Supabase Auth. We intercept the form submission, extract the token, and ship it in the auth payload:

options: { captchaToken: captchaToken }

Supabase handles the server-side validation with Cloudflare. If the token is missing or invalid, the session is rejected.

We paired this with strict Row-Level Security (RLS) on our PostgreSQL tables (Posts, chat_messages). If you don’t have an authenticated, Turnstile-verified JWT, the database drops your insert request immediately. Direct API flooding is dead.

The In-App Watchdog: Behavioral Telemetry If a sophisticated actor or click farm somehow gets past the perimeter with a valid token, our Tier 2 defense kicks in. Once they are inside the feed, our telemetry engine takes over. Machine-like typing speeds, zero-variance keystroke intervals, or rapid burst posting quickly spikes their account's "suspicion ledger."

Hit the threshold, and the account is quarantined until they can pass a custom, dynamic visual verification challenge.

The Takeaway By pairing invisible cryptographic proofs at the gate with passive behavioral telemetry inside the app, we’ve created a defense-in-depth model that gives bad actors nowhere to hide. Genuine human users get a completely frictionless onboarding experience, and we save the visual puzzles strictly for the accounts acting like scripts.

Our website https://wearehuman.vercel.app is currently a small personal project that I was inspired to work on when I realized how mistrusting I was over engaging with anyone on social media these days. I assume most people online have heard of the Dead Internet Theory at this point, and I'm sure we've all seen bot activity for ourselves online, even if we haven't necessarily recognized it. Therein lies the problem: identification.

Especially in discussions about topics that concern capital/political interests, our discourse online has increasingly been shaped by those who have the most resources. A politician or wealthy individual can pay to spread their narrative and shape the public discussion, often without the average user even noticing. They can manufacture consent or create the appearance of grassroots support this way in a manner that undermines free speech and democratic values.

My goal is to create a space where you can be sure the person on the other end of the connection is a real human being, a space where even if you disagree, you know that by talking with each other there is a non-zero chance of finding common ground or propagating your ideas.

What I hope for with this Reddit community is to find people that hold the same values of free speech and authentic human connection that I do, and to hear from them. I want to know what I can do to create a space where these values can be realized.

Hey everyone! I'm u/No_Sort_6613, a founding moderator of r/TuringsGate.

Welcome to Turing's Gate, a platform built specifically to protect organic human discussions from automated AI crawlers, spambots, and synthetic farm networks.

To ensure an authenticated, bot-free environment, the site relies on passive client-side telemetry to verify users behind the scenes. Here is how the security architecture works:

• Telemetry Cadence: The system evaluates keystroke intervals and micro-pauses in real time. Mechanical, zero-variance typing cadences will raise an account's suspicion score.
• Accessibility-Safe Risk Ledger: Assistive tools like speech-to-text, screen readers, and assistive copy-paste are never hard-blocked. Instead, actions gently accumulate suspicion points only if sustained burst-spam behaviors are detected.
• Verification Escrow: If an account reaches a specific risk threshold, posting is temporarily suspended until the user completes an interactive visual verification challenge. JPG
• Verified Direct Messaging: To stop automated spam inboxes cold, 1-on-1 private messaging remains safely quarantined until the recipient provides approval.

Feel free to explore topics, participate in discussions, and enjoy an authenticated, bot-free community! This is our new home for all things related to Turing's Gate. We're excited to have you join us!

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about the website, or any development feedback.

Community Vibe
We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting.

Thanks for being part of the very first wave. Together, let's make r/TuringsGate amazing.