[opensourcedex]

Tirreno is a free, open source fraud prevention project written in PHP and released under AGPL-3.0. It has 1,513 GitHub stars, 179 forks and 9 open issues, and was last pushed 1 months ago. On this registry it ranks #1 of 2 tracked projects in Fraud Prevention, with 5 head-to-head comparisons available. It gained 2 stars over the last 6 tracked days.

What is Tirreno?

What it is

Tirreno is an open-source security framework written in PHP and backed by PostgreSQL under AGPL-3.0. It lives in the application security and fraud-prevention ecosystem, where it runs as a self-hosted web application. The project describes itself as a few-dependency, hand-written application that can be installed quickly and used to ingest product events through API calls.

The problem it addresses is that many breaches and abuses do not stop at perimeter controls. Compromised accounts, application logic abuse, fraud, spam, and insider risk can occur after traffic has passed firewalls, WAFs, or SIEM alerts. Tirreno places monitoring inside the product: it tracks events, scores risk, and gives operators a dashboard and review workflow for suspicious user behavior.

Key capabilities

  • SDKs and API integration let a product send events with context in a few lines of code.
  • Built-in dashboard provides real-time monitoring of security events from one interface.
  • Single-user view shows behavior patterns, risk scores, connected identities, and activity timelines for one account.
  • Rule engine calculates risk scores automatically with preset or custom rules.
  • Review queue can suspend accounts with risky events or flag them for manual review through thresholds.
  • Field audit trail records modifications to important fields, including what changed and when, for audit and compliance work.
  • Preset rules cover account takeover, credential stuffing, spam, registration, fraud, insider threat, bots, dormant accounts, multi-accounting, promo abuse, API protection, and high-risk regions.

Who uses it and how

  • Self-hosted, internal, and legacy apps can embed a security layer with audit trails, account-takeover protection, threat detection, and insider monitoring.
  • SaaS and digital platforms can prevent cross-tenant data leakage, online fraud, privilege escalation, data exfiltration, and business logic abuse.
  • E-commerce and marketplaces can detect payment fraud, account abuse, fake reviews, promo-code exploitation, inventory manipulation, credential stuffing, and carding attacks.
  • Mission-critical, air-gapped, industrial, and API-first deployments can monitor service accounts, API keys, bot behavior, rate-limiting bypasses, scraping, and unauthorized access.

Getting started

The README gives a Docker-based installation with the command curl -sL tirreno.com/t.yml | docker compose -f - up -d, plus a manual ZIP quickstart for a web server. It requires PHP 8.0 to 8.3, PostgreSQL 12 or greater, Apache with mod_rewrite and mod_headers, and a Unix-like operating system.

When to use it — and when not to

Tirreno is useful when an organization wants in-product event monitoring, risk scoring, and account review inside its own infrastructure, especially where perimeter tools miss application logic abuse. It is less suitable for teams wanting a managed service, because the self-hoster must operate PHP, PostgreSQL, Apache, storage growth of about 3 GB per one million events, and rule tuning. The repository facts show a young project with zero listed contributors and nine open issues, and no paid-product comparison is provided, so adoption should weigh maintenance capacity and AGPL obligations.

project readme (upstream, from github) — read inline

tirreno

Codacy Badge Docker Pulls

tirreno screenshot

tirreno is a security framework.

tirreno [tir.ˈrɛ.no] helps understand, monitor, and protect your product from threats, fraud, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised accounts and application logic abuse that bypasses firewalls, SIEM, WAFs, and other defenses. tirreno detects threats where they actually happen: inside your product.

tirreno is a hand-written, few-dependency, "low-tech" PHP/PostgreSQL application. After a straightforward five-minute installation, you can ingest events through API calls and immediately access a real-time threat dashboard.

Core components

  • SDKs & API Integrate tirreno into any product with SDKs. Send events with full context in a few lines of code.
  • Built-in dashboard Monitor and understand your product's security events from a single interface. Ready for use in minutes.
  • Single user view Analyze behaviour patterns, risk scores, connected identities, and activity timelines for a specific user.
  • Rule engine Calculate risk scores automatically with preset rules or create your own customized for your product.
  • Review queue Automatically suspend accounts with risky events or flag them for manual review through threshold settings.
  • Field audit trail Track modifications to important fields, including what changed and when to streamline audit and compliance.

Preset rules

Account takeover Credential stuffing Content spam Account registration Fraud prevention Insider threat Bot detection Dormant account Multi-accounting Promo abuse API protection High-risk regions

Built for

  • Self-hosted, internal and legacy apps: Embed security layer to extend your security through audit trails, protect user accounts from takeover, detect cyber threats and monitor insider threats.
  • SaaS and digital platforms: Prevent cross-tenant data leakage, online fraud, privilege escalation, data exfiltration and business logic abuse.
  • E-commerce and online marketplaces: Detect payment fraud, account abuse, fake reviews, promotional code exploitation, inventory manipulation, and protect against credential stuffing and carding attacks.
  • Mission critical applications: Sensitive application protection, even in air-gapped deployments.
  • Industrial control systems (ICS) and command & control (C2): Protect, operational technology, command systems, and critical infrastructure platforms from unauthorized access and malicious commands.
  • Non-human identities (NHIs): Monitor service accounts, API keys, bot behaviors, and detect compromised machine identities.
  • API-first applications: Protect against abuse, rate limiting bypasses, scraping, and unauthorized access.

Live demo

Check out the live demo at play.tirreno.com (admin/tirreno).

Requirements

  • PHP: Version 8.0 to 8.3
  • PostgreSQL: Version 12 or greater
  • PHP extensions: PDO_PGSQL, cURL
  • HTTP web server: Apache with mod_rewrite and mod_headers enabled
  • Operating system: A Unix-like system is recommended
  • Minimum hardware requirements:
    • PostgreSQL: 512 MB RAM (4 GB recommended)
    • Application: 128 MB RAM (1 GB recommended)
    • Storage: Approximately 3 GB PostgreSQL storage per 1 million events

Docker-based installation

To run tirreno within a Docker container you may use command below:

curl -sL tirreno.com/t.yml | docker compose -f - up -d

Continue with step 4 of Quickstart.

Quickstart install

  1. Download the latest version of tirreno (ZIP file).
  2. Extract the tirreno-master.zip file to the location where you want it installed on your web server.
  3. Navigate to http://localhost:8585/install/index.php in a browser to launch the installation process.
  4. After the successful installation, delete the install/ directory and its contents.
  5. Navigate to http://localhost:8585/signup/ in a browser to create an administrator account.
  6. For cron job setup, insert the following schedule (every 10 minutes) expression with the crontab -e command or by editing the /var/spool/cron/your-web-server file:
*/10 * * * * /usr/bin/php /absolute/path/to/tirreno/index.php /cron

Using Heroku (optional)

Click here to launch heroku deployment.

Via Composer and Packagist (optional)

tirreno is published at Packagist and could be installed with Composer:

composer create-project tirreno/tirreno

or could be pulled into an existing project:

composer require tirreno/tirreno

SDKs

Custom page examples

tirreno ingests the universal primitives (users/entities, IPs, devices, sessions, events) and exposes them through composable machinery: the rule engine, the tirreno('queries') builder, and the file-based assets/pages/ extension system — through which an operator can express whatever risk model they have. The examples below show custom pages built on that extension system.

LLM bots

Risk users

Documentation

See the User guide for details on how to use tirreno, Developers documentation to customize your integration, Admin documentation for installation, maintenance and updates.

About

tirreno is is a free, open source security framework. Event tracking, threat detection, and risk scoring for any product.

The project started as a proprietary system in 2021 and was open-sourced (AGPL) in December 2024.

Behind tirreno is a blend of extraordinary engineers and professionals, with over a decade of experience in cyberdefence. We solve real people's challenges through love in ascétique code and open technologies. tirreno is not VC-motivated. Our inspiration comes from the daily threats posed by organized cybercriminals, driving us to reimagine the place of security in modern applications.

Why the name tirreno?

Tyrrhenian people may have lived in Tuscany and eastern Switzerland as far back as 800 BC. The term "Tyrrhenian" became more commonly associated with the Etruscans, and it is from them that the Tyrrhenian Sea derives its name, which is still in use today.

According to historical sources, Tyrrhenian people were the first to use trumpets for signaling about coming threats, which was later adopted by Greek and Roman military forces.

While working on the logo, we conducted our own historical study and traced mentions of 'tirreno' back to the 15th-century printed edition of the Vulgate (the Latin Bible). We kept it lowercase to stay true to the original — quite literally, by the book. The tirreno wordmark stands behind the horizon line, as a metaphor of the endless evolutionary cycle of the threat landscape and our commitment to rise over it.

Links

Reporting a security issue

readme truncated — read the full docs on github

Frequently asked questions

Is Tirreno free to use?

Tirreno is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Tirreno do?

Security framework that protects from within your product

What is Tirreno written in?

Tirreno is primarily written in PHP. Its source is publicly available at https://github.com/tirrenotechnologies/tirreno, and it has 1,513 GitHub stars.