Your sign-up form is a weapon

A SaaS founder describes discovering their sign-up and forgot-password forms were being exploited in a subscription bombing attack — where bots register real victims' emails across many sites to flood their inboxes and bury important security alerts. The attack was low-volume (1-2 sign-ups/hour) and designed to evade rate limiting. The fix involved tightening firewall bot detection, adding Cloudflare Turnstile (integrated via Better Auth's built-in CAPTCHA plugin), and restricting all emails except the verification email until the address is confirmed. The post argues that any sign-up form that emails unverified addresses is complicit in this attack, and urges developers to treat CAPTCHA and email gating as baseline requirements, not optional tasks.