Anti-fraud and rate limits

Any reward worth having gets gamed. These protections run on every Qubed page, on every plan, with nothing to set up.

The queue lives on the server

Every signup goes to a server route. Position, duplicate detection, referral credit and your plan's subscriber limit are all worked out on the server against the full list. Nothing a visitor's browser sends can set their own place in line.

Rate limits

At most 5 signups per minute and 30 per hour from one IP address. Extra requests get a 429 with the error code rate_limited, so a script hammering your form is turned away before anything is saved.

A honeypot for bots

The form on every template includes a hidden field that people never see. Bots that fill in every field get a normal-looking response and nothing is saved.

One signup per email

Emails are normalized to lowercase and the database enforces one signup per address per page, even when two requests arrive at the same moment.

No self-referral, no cross-page codes

A referral code only counts on the page it belongs to, and the referrer has to already be on the list. A new signup can't credit itself.

Not shipped yet

Disposable-domain blocking, MX-record checks and a per-code cooldown are on the roadmap. This page will say so when they land. Read the waitlist fraud guide for the reasoning behind these rules, or the referral waitlist feature for the full loop.