Spam protection for sign-up forms #42

New issue

Closed

opened 2026-10-15 01:19:17 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-15 01:19:17 -04:00

Owner

Today: the public submit endpoint accepts anything from anyone. Bots can fill a list with fake or hostile addresses, and with double opt-in that makes Postak send confirmation emails to strangers.

Plan

Always on:
- a hidden honeypot field
- a minimum fill time
- per-IP and per-form rate limits (building on the Phase 10 rate-limiting issue)
An optional "require captcha" setting per form:
- a self-hosted proof-of-work challenge, so no third party sees visitors (preferred), or
- a configurable provider such as Cloudflare Turnstile or hCaptcha, with the keys set by the administrator
Rejected submissions get the same generic response and are logged with a reason, but no email addresses are logged.

**Today:** the public submit endpoint accepts anything from anyone. Bots can fill a list with fake or hostile addresses, and with double opt-in that makes Postak send confirmation emails to strangers. **Plan** - Always on: - a hidden honeypot field - a minimum fill time - per-IP and per-form rate limits (building on the Phase 10 rate-limiting issue) - An optional "require captcha" setting per form: - a self-hosted proof-of-work challenge, so no third party sees visitors (preferred), or - a configurable provider such as Cloudflare Turnstile or hCaptcha, with the keys set by the administrator - Rejected submissions get the same generic response and are logged with a reason, but no email addresses are logged.

vmanne-poc added this to the Phase 11: Sign-up forms milestone

2026-10-15 01:19:17 -04:00

vmanne-poc added the

security

feature

labels

2026-10-15 01:19:17 -04:00

vmanne-poc referenced this issue from a commit

2026-10-15 09:31:16 -04:00

Sign-up forms: hosted page and embed, validated settings, opt-in and welcome emails, spam protection

vmanne-poc referenced this issue from a commit

2026-10-15 09:31:16 -04:00