Security
The security gate that defaulted to off
Our docs called the bot challenge mandatory. The env flag behind it defaulted to false in the deploy config, so a routine deploy would ship the gate down.
Restorable but not shareable: hiding a token in history.state
A result that survives refresh and the back button but cannot be shared by copying the URL. A forgotten browser API, a header, and one deliberate deletion.
Our rate limits were bypassed by a trailing slash
Five tuned Rack::Attack throttles, all matching the path exactly. Rails normalised the path after they ran, so a dot-json or a trailing slash bypassed every one.
Treat model output like user input
When strangers write the prompt and the answer renders on your page, you have two untrusted boundaries back to back. The layered posture we settled on.
Layered bot defense for a public form: honeypot, Turnstile, email verification, and the pieces between
A public, unauthenticated form that writes to the database and sends email is a bot's favorite denial-of-service target. No single control is enough. The point is layering honeypot, Turnstile, rate limiting, and email verification so one layer failing doesn't sink the rest.
