sign up security

[devinhadley]

Currently anyone can enumerate logins & spam account creation.

Consider approaches for restricting # of sign ups.

i.e.

https://www.cloudflare.com/products/turnstile/

[devinhadley]

password reset will need similar functionality

[devinhadley]

consider

→ Turnstile middleware
→ reject if missing/invalid token

[devinhadley]

possibly beyond the scope of this repository.

consider a branch or fork....