tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks, and account takeover via a rule engine and audit trails.
tirreno is a security framework.
tirreno [tir.ˈrɛ.no] helps understand, monitor, and protect your product from threats, fraud, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised accounts and application logic abuse that bypasses firewalls, SIEM, WAFs, and other defenses. tirreno detects threats where they actually happen: inside your product.
tirreno is a hand-written, few-dependency, "low-tech" PHP/PostgreSQL application. After a straightforward five-minute installation, you can ingest events through API calls and immediately access a real-time threat dashboard.
Account takeover Credential stuffing Content spam Account registration Fraud prevention Insider threat
Bot detection Dormant account Multi-accounting Promo abuse API protection High-risk regions
Check out the live demo at play.tirreno.com (admin/tirreno).
PDO_PGSQL, cURLApache with mod_rewrite and mod_headers enabledTo run tirreno within a Docker container you may use command below:
curl -sL tirreno.com/t.yml | docker compose -f - up -d
Continue with step 4 of Quickstart.
http://localhost:8585/install/index.php in a browser to launch the installation process.install/ directory and its contents.http://localhost:8585/signup/ in a browser to create an administrator account.crontab -e command or by editing the /var/spool/cron/your-web-server file:*/10 * * * * /usr/bin/php /absolute/path/to/tirreno/index.php /cron
Click here to launch heroku deployment.
tirreno is published at Packagist and could be installed with Composer:
composer create-project tirreno/tirreno
or could be pulled into an existing project:
composer require tirreno/tirreno
tirreno ingests the universal primitives (users/entities, IPs, devices, sessions, events) and exposes them through composable machinery: the rule engine, the tirreno('queries') builder, and the file-based assets/pages/ extension system — through which an operator can express whatever risk model they have. The examples below show custom pages built on that extension system.
See the User guide for details on how to use tirreno, Developers documentation to customize your integration, Admin documentation for installation, maintenance and updates.
tirreno is is a free, open source security framework. Event tracking, threat detection, and risk scoring for any product.
The project started as a proprietary system in 2021 and was open-sourced (AGPL) in December 2024.
Behind tirreno is a blend of extraordinary engineers and professionals, with over a decade of experience in cyberdefence. We solve real people's challenges through love in ascétique code and open technologies. tirreno is not VC-motivated. Our inspiration comes from the daily threats posed by organized cybercriminals, driving us to reimagine the place of security in modern applications.
Tyrrhenian people may have lived in Tuscany and eastern Switzerland as far back as 800 BC. The term "Tyrrhenian" became more commonly associated with the Etruscans, and it is from them that the Tyrrhenian Sea derives its name, which is still in use today.
According to historical sources, Tyrrhenian people were the first to use trumpets for signaling about coming threats, which was later adopted by Greek and Roman military forces.
While working on the logo, we conducted our own historical study and traced mentions of 'tirreno' back to the 15th-century printed edition of the Vulgate (the Latin Bible). We kept it lowercase to stay true to the original — quite literally, by the book. The tirreno wordmark stands behind the horizon line, as a metaphor of the endless evolutionary cycle of the threat landscape and our commitment to rise over it.
If you've found a security-related issue with tirreno, please email [email protected]. Submitting the issue on GitHub exposes the vulnerability to the public, making it easy to exploit. We will publicly disclose the security issue after it has been resolved.
After receiving a report, tirreno will take the following steps:
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License (AGPL) as published by the Free Software Foundation version 3.
The name "tirreno" is a registered trademark of tirreno technologies sàrl, and tirreno technologies sàrl hereby declines to grant a trademark license to "tirreno" pursuant to the GNU Affero General Public License version 3 Section 7(e), without a separate agreement with tirreno technologies sàrl.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see GNU Affero General Public License v3.
tirreno Copyright (C) 2026 tirreno technologies sàrl, Vaud, Switzerland. (License AGPLv3)
't'