... users did, within hours of launching, all our dms got spammed by scammers trying to selling me upvotes and " we will get you to top 3 rank " little do they know our organic support is far better than their botnet Its incredible how just a week of planning can give you the best results. Although we have been building Construct for 6+ months, we only recently decided to launch it here, just to put ourselves out there, we simply wanted ...

... tech stack. They were relying on popular "security" modules that simply changed the admin login URL to a custom path a classic case of security by obscurity. Spoiler: It didn't help at all. Judging by the logs, automated botnets had been hammering the server 24/7 for weeks. These bots don't care about custom admin URLs or what framework you use. They scan everything indiscriminately, probing REST APIs, flooding common gateways, and looking for zero-day vulnerabilities ...

... Appreciate the signal on rate limits, that's shipping before launch too. Comment from Mustafa Arian(@thenameisarian): good positioning. the unsexy moat for form backends is spam handling. once a public form is up, you get hammered by botnet submissions in the first 72 hours. the form backends that fail are the ones that did not ship rate limits, honeypots, and adaptive captcha by default. how are you handling that on the free tier? if you can offer a clean ... ... experience without forcing users to add hcaptcha themselves, you have a real differentiator vs