Two signup/forgot-password protections added after Tor-based signup spam (gibberish first names, no referrer, silent Turnstile solves from Cloudflare country T1).

Tor exit check

On signup and forgot-password server actions, Peels reads the visitor IP (x-real-ip, with a fallback to the first x-forwarded-for hop) and compares it to the public Tor Project exit list (https://check.torproject.org/torbulkexitlist).

• Matches get a generic error. We do not mention Tor.
• Map and other pages are not checked. Tor users can still browse.
• The list is cached in memory for about an hour. Cold fetches have an 8 second timeout and fail open (allow the request) if the list cannot load.
• Code: src/lib/torExit.ts, used from signUpAction and forgotPasswordAction.

This is app-side, not a Vercel Firewall country rule. Vercel geo is the exit's real country, not Cloudflare's special T1 code.

Signup honeypot

The signup form includes a visually hidden text field named contact_website. Real people never see it. Autofill spam scripts often fill fields that look like a website/URL input.

If that field is non-empty, the server returns the normal signup success redirect and does not create a Supabase user or send email.

Code: SignUpForm + signUpAction.

Related

Turnstile stays in managed / interaction-only mode. See <page url="https://app.notion.com/p/2c7b37e1678f80dc9adae36d39c7dc88">Cloudflare Turnstile Implementation</page>.