Rails
Charge the quota when you deliver value, not when you accept the request
A visitor gets two free runs. Two dead links later they have used both and received nothing. Where you decrement a quota is a product decision in disguise.
The security gate that defaulted to off
Our docs called the bot challenge mandatory. The env flag behind it defaulted to false in the deploy config, so a routine deploy would ship the gate down.
Two honest counts, one wrong number: Counter and Validator count different things
The live counter said 5,982 of 6,000. The server said too long. Both were honest; they were counting different strings, and multipart encoding was why.
Our rate limits were bypassed by a trailing slash
Five tuned Rack::Attack throttles, all matching the path exactly. Rails normalised the path after they ran, so a dot-json or a trailing slash bypassed every one.
Layered bot defense for a public form: honeypot, Turnstile, email verification, and the pieces between
A public, unauthenticated form that writes to the database and sends email is a bot's favorite denial-of-service target. No single control is enough. The point is layering honeypot, Turnstile, rate limiting, and email verification so one layer failing doesn't sink the rest.
