Anti-fraud and rate limits

Every signup hits a server route at /api/waitlist/subscribe. Nothing about your queue is computed in the visitor's browser: position, duplicate detection, referral attribution, and your plan's subscriber cap are all resolved server-side against the full list. The subscribers.ip_address column stores the source IP for the audit trail.

Rate limits: 5 signups per IP per minute and 30 per IP per hour. Excess requests get a 429 with the error code rate_limited.

Email validation checks address shape and length before any write. Duplicate signups are rejected at the database level by a unique constraint on (page_id, email), so the same address can't join one list twice even under a race.

Referral codes are resolved scoped to the page they belong to, so a code from someone else's list can't be redeemed against yours. Self-referral is impossible by construction: the referrer has to already exist in the list, and a new signup does not.

Referral positions are recomputed, never decremented in place. Each subscriber's join order is stored separately from their effective position, so a fraudulent referral can be reversed and the queue rebuilt exactly.

Not yet shipped: disposable-domain blocking, MX-record checks, and a same-IP cooldown per referral code. They're on the roadmap — this page will say so when they land.