EBElijah Browninelijahbrown.hashnode.dev·9h ago · 9 min readHalf your waitlist is bots? Three server-side checks in NodeYou open your waitlist table and something is off. Rows arrive in bursts, half of them are the same Gmail address with different dots and plus tags, and a fair number sit on domains that don't exist. 00
EBElijah Browninelijahbrown.hashnode.dev·12h ago · 10 min readYour AI-built app's signup is open to anyone who calls the APIIf you built your app with Lovable, Bolt or Cursor on Supabase, your signup form is a suggestion. The form runs in the browser, and so do the Supabase URL and the anon (or publishable) key it uses. An02F
EBElijah Browninelijahbrown.hashnode.dev·1d ago · 7 min readScreening Supabase signups before the user is createdMost signup forms check the shape of what people type and stop there. That catches typos, but not a well formed address at a known throwaway email provider, or a phone number that is valid on paper bu00