Anubis ships opt-in WebAssembly checks after a year of work

Why it matters

Anubis shows the hidden cost of turning a fast open-source fix into dependable infrastructure: compatibility and deployment discipline can dwarf the core code.

Anubis's September 6th, 2026 retrospective details roughly a year of work on WebAssembly proof-of-work methods, culminating in an opt-in prerelease. Techaro CEO Xe Iaso (@theprincessxena) built the open-source anti-scraping proxy after an Amazon scraper overwhelmed xer's personal Git server. Iaso set out the development history in the September 6th retrospective.

Techaro published Anubis v1.28.0-pre1 on August 30th, 2026, as a prerelease rather than a production release. It can make visitors solve proof-of-work challenges implemented in Rust and compiled to WebAssembly, using Argon2id, HashX or SHA-256. Clients without WebAssembly receive a pure-JavaScript fallback generated through wasm2js.

Administrators must opt in to the new challenge methods, which are disabled by default while the release remains labeled a prerelease. A year's work has produced opt-in methods, a sensible outcome for software designed to sit directly in front of other people's websites.

An afternoon fix became a company-sized obligation

Iaso is Techaro's CEO and an infrastructure engineer whose resume includes Heroku, Lightspeed POS, Tailscale, Fly.io and Tigris Data. Xe founded Tailscale's developer-relations function before doing similar technical education work elsewhere, experience that shows in Anubis's unusually public design discussions and operational documentation.

Anubis began with a much narrower problem. In an Open Source Security interview, Iaso said Amazon's scraper was hammering xer's Git server. Xe initially built Anubis to defend that server and later released it publicly.

Anubis's repository describes the project as a protection layer for upstream services. Requests that appear suspicious can be blocked or presented with a browser challenge. In the interview, Iaso described proof of work as a rate-limiting barrier that imposes computational work on a client while allowing the server to check the result efficiently.

The mechanism is intentionally blunt. The repository calls Anubis "a bit of a nuclear response" and says it can interfere with legitimate automation, including archival crawlers such as the Internet Archive.

WebAssembly was on the early roadmap

Iaso listed a WebAssembly checker in an April 16th, 2025 sustainability plan. At the time, xe described Anubis as a nights-and-weekends side project and placed the work in the first phase of a sponsorship plan covering easier installation, documentation and integrations with Caddy, Nginx and Traefik.

The project's v1.22.0 release discussion says the September 6th, 2025 release overhauled proof-of-work solving, moved Web Workers into dedicated JavaScript files and prepared the project for non-SHA-256 methods, including eventual WebAssembly support.

The subsequent work spread well beyond writing a hashing routine. The v1.28.0-pre1 changelog records separate changes for Rust challenge code, a Go package, browser integration, documentation, precompiled wasm-opt and wasm2js tools, CI coverage and resilience fixes. The changelog also says the release adds a wazero-exec fallback for running WASI modules on different hosts.

The release notes say clients that cannot use WebAssembly receive a pure-JavaScript version generated through wasm2js. That fallback broadens browser compatibility and adds another code path to maintain; excluding browsers without WebAssembly would turn a performance feature into another access barrier.

The fallback gives up the parallelism and fuller CPU utilization Iaso described for the WebAssembly path. The release notes identify a known limitation: Anubis's progress bar does not update during a wasm2js check.

Faster challenges do not settle the bot fight

WebAssembly gives Iaso room to use proof-of-work functions beyond the original JavaScript solver and to make better use of a visitor's processor.

Automated access remains possible. A determined operator can run browser code, solve computational challenges or move the work onto more efficient hardware. Anubis depends partly on economics and partly on inconvenience: each extra requirement removes low-effort crawlers and raises the operating cost for the rest.

Anubis gives operators source code and control over their own traffic without requiring them to route a site through a security vendor. It also hands them the configuration and compatibility work.

Keeping the new challenge methods disabled by default is the important part of the prerelease. Iaso has placed the faster engine in operators' hands while leaving activation to administrators who are prepared to test it.