Abuse and cost

Add bot protection to public forms

Add Cloudflare Turnstile, hCaptcha or Vercel BotID, plus email verification, so spam signups don't burn email and AI credits.

Why it matters

Bots fill signup and contact forms within days of launch. Each fake signup can trigger emails, AI calls and database rows you pay for.

How to fix it

1. Add a challenge such as Cloudflare Turnstile, hCaptcha or Vercel BotID, and verify the token on the server.
2. Require email verification before unlocking anything that costs you money.
3. Add a hidden honeypot field and rate limits as cheap extra layers.

How to verify

• Submit the form from a script without a challenge token; the server should reject it.

Related checks

• Rate limit expensive and auth endpoints
• Keep storage buckets private unless they must be public
• Cap your AI spend

Tick it off in the full checklist