Sep 20266 min
Bots Are Signing Up Through Your Supabase OTP Endpoint, and Your SES Reputation Pays for It
Supabase creates a user and mails a code for any address it has not seen, so a script pointed at /auth/v1/otp turns your sender into a mail cannon. A honeypot cannot see it and project-wide CAPTCHA breaks every installed build of your mobile app. A Before User Created hook does the job.