Library · Operations
Detecting cracks in the wild: signals and tuning thresholds
Cracked builds leave traces on the server: bad signatures, replays, one key on too many machines, unknown builds. Watch them as a scoring system, not as separate alarms.
Signals worth trusting
- Repeated bad request signatures from one license: someone is editing packets.
- Replayed nonces: someone is recording and resending.
- One key on many machines beyond the limit in a short time: a shared key.
- An unknown build: a file matching nothing you published.
A risk score, not a switch
Weight each signal, cap each type, and let the score decay over time. A machine whose clock jumped once is not a license sending 25 bad signatures in a minute.
Tuning
- Start in alert-only mode for a few weeks.
- Look at who crosses the line and how many are real buyers.
- Turn on automatic sign-out at the middle level and suspension at the high one.
- Keep every action reversible and noted.
With ClavisAUH
Protect 24/7 scores licenses, devices and IPs. In Advanced Protection, turn on Graduated Enforcement once your thresholds feel right. Acting on its own runs on Premium, Basic only alerts.