Why it matters
A signup form that sends a confirmation email can be used to send thousands of emails to strangers in your name. That gets your domain blocked by inbox providers. We can only see protection that shows up in the browser, so treat this as a prompt to check, not a verdict.
How Patch checks
We look for reCAPTCHA, hCaptcha, Cloudflare Turnstile or similar on pages with signup or contact forms. Server-side rate limiting is invisible to us, which is why this is low severity.
How to fix it
- Add a CAPTCHA such as Cloudflare Turnstile or hCaptcha to the forms on the affected pages, or confirm you rate-limit them on the server.
- Limit signups and password resets per IP address and per email address.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.