diff --git a/apps/web/package.json b/apps/web/package.json
index e1a7950..93ff1c4 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -12,7 +12,7 @@
     "@iarna/toml": "^2.2.5",
     "@profullstack/autoblog": "github:profullstack/autoblog#v0.4.0",
     "@profullstack/pluginstore": "^0.1.1",
-    "@profullstack/stack": "^0.1.3",
+    "@profullstack/stack": "^0.2.0",
     "@profullstack/x402-gateway": "^0.1.0",
     "@supabase/supabase-js": "^2.101.1",
     "@threatcrush/scan": "workspace:*",
@@ -22,7 +22,8 @@
     "qrcode.react": "^4.2.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "resend": "^6.12.2"
+    "resend": "^6.12.2",
+    "server-only": "^0.0.1"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
diff --git a/apps/web/src/app/api/contact/route.ts b/apps/web/src/app/api/contact/route.ts
index 0b993f6..6f7a306 100644
--- a/apps/web/src/app/api/contact/route.ts
+++ b/apps/web/src/app/api/contact/route.ts
@@ -1,4 +1,5 @@
 import { createContactRoute } from "@profullstack/stack/email";
+import { contactGuard } from "@/lib/contact-guard";
 import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 
 let supabase: SupabaseClient | undefined;
@@ -40,7 +41,12 @@ function messageWithExtras(s: {
 export const POST = createContactRoute({
   from: "ThreatCrush <hello@threatcrush.com>",
   to: "hello@threatcrush.com",
-  honeypot: false,
+  // Was `false`, with nothing in its place. The field is rendered now, so
+  // it can actually fire.
+  honeypot: "website",
+  // Requires a token minted when the form rendered. Runs before field
+  // validation, so a bot never learns which fields the route wants.
+  guard: contactGuard ?? undefined,
   fieldLabels: FIELD_LABELS,
   subject: (s) =>
     `[ThreatCrush] New ${s.fields.topic ?? "general"} inquiry from ${s.name}`,
diff --git a/apps/web/src/app/hire/page.tsx b/apps/web/src/app/hire/page.tsx
index 101bf9f..1736361 100644
--- a/apps/web/src/app/hire/page.tsx
+++ b/apps/web/src/app/hire/page.tsx
@@ -1,6 +1,7 @@
 import type { Metadata } from "next";
 import { SITE_URL } from "@/lib/blog";
 import { HireForm } from "@/components/HireForm";
+import { contactGuard } from "@/lib/contact-guard";
 
 export const metadata: Metadata = {
   title: "Hire Us — human-led security assessments",
@@ -88,7 +89,14 @@ const steps = [
   },
 ];
 
-export default function HirePage() {
+// The hire form carries a token minted at render time, so this page must
+// not be cached. A stale page would hand every visitor the same dead token.
+export const dynamic = "force-dynamic";
+
+export default async function HirePage() {
+  const token = contactGuard ? await contactGuard.issue() : null;
+  const guardFields = token ? contactGuard!.fields(token) : null;
+
   return (
     <div className="min-h-screen bg-tc-darker pt-24 pb-20">
       <script
@@ -182,7 +190,11 @@ export default function HirePage() {
             usually the same business day.
           </p>
           <div className="mt-6">
-            <HireForm />
+            <HireForm
+              token={token}
+              tokenName={guardFields?.token.name ?? null}
+              honeypotName={guardFields?.honeypot.name ?? null}
+            />
           </div>
         </section>
       </main>
diff --git a/apps/web/src/components/HireForm.tsx b/apps/web/src/components/HireForm.tsx
index 38dc0c4..48922dc 100644
--- a/apps/web/src/components/HireForm.tsx
+++ b/apps/web/src/components/HireForm.tsx
@@ -11,7 +11,16 @@ const labelClass = "block text-sm font-medium text-tc-text-dim mb-1.5";
 // Posts to the shared /api/contact route with topic "hire"; the extra fields
 // (target, stack, timeline) ride along as labelled rows in the notification
 // email and are appended to the persisted message.
-export function HireForm() {
+export function HireForm({
+  token,
+  tokenName,
+  honeypotName,
+}: {
+  /** Minted by the page at render time; proves the form was loaded. */
+  token: string | null;
+  tokenName: string | null;
+  honeypotName: string | null;
+}) {
   const [name, setName] = useState("");
   const [email, setEmail] = useState("");
   const [company, setCompany] = useState("");
@@ -20,6 +29,8 @@ export function HireForm() {
   const [timeline, setTimeline] = useState("");
   const [message, setMessage] = useState("");
   const [status, setStatus] = useState<Status>("idle");
+  // Honeypot. Nothing visible sets this, so anything in it came from a bot.
+  const [honeypot, setHoneypot] = useState("");
   const [error, setError] = useState("");
 
   const handleSubmit = useCallback(
@@ -41,6 +52,8 @@ export function HireForm() {
             timeline,
             message,
             topic: "hire",
+            ...(tokenName && token ? { [tokenName]: token } : {}),
+            ...(honeypotName ? { [honeypotName]: honeypot } : {}),
           }),
         });
 
@@ -91,6 +104,23 @@ export function HireForm() {
           </div>
         ) : (
           <form onSubmit={handleSubmit} className="space-y-4">
+            {/* Honeypot. Off-canvas rather than display:none, because some
+                bots skip fields they can tell are not rendered. */}
+            {honeypotName && (
+              <div aria-hidden="true" className="absolute -left-[9999px] h-px w-px overflow-hidden">
+                <label>
+                  Website
+                  <input
+                    type="text"
+                    name={honeypotName}
+                    value={honeypot}
+                    onChange={(e) => setHoneypot(e.target.value)}
+                    tabIndex={-1}
+                    autoComplete="off"
+                  />
+                </label>
+              </div>
+            )}
             <div className="grid gap-4 sm:grid-cols-2">
               <div>
                 <label htmlFor="hire-name" className={labelClass}>
diff --git a/apps/web/src/lib/contact-guard.ts b/apps/web/src/lib/contact-guard.ts
new file mode 100644
index 0000000..2c6dce1
--- /dev/null
+++ b/apps/web/src/lib/contact-guard.ts
@@ -0,0 +1,41 @@
+import "server-only";
+import { createContactGuard } from "@profullstack/stack/email";
+
+/**
+ * Shared guard for the public contact form.
+ *
+ * The page mints a token when it renders; the route verifies one when the
+ * form comes back. Both import this instance, because a `binding` or
+ * field-name mismatch between them would reject every real submission
+ * without saying so.
+ *
+ * This route had anti-spam switched off entirely (`honeypot: false`) and
+ * nothing in its place. The honeypot is back on and now actually rendered,
+ * but on its own it would still miss the common case: contact-form spam
+ * POSTs straight at /api/contact without loading the page, which leaves a
+ * hidden field absent from the body rather than filled. The token is the
+ * part a request that skipped the page cannot produce.
+ *
+ * The secret never reaches the browser, only the signature does. It has to
+ * be identical across every instance serving the form, so it falls back to
+ * RESEND_API_KEY, which sending already cannot work without.
+ */
+const secret = process.env.FORM_GUARD_SECRET ?? process.env.RESEND_API_KEY ?? "";
+
+if (!secret) {
+  console.warn(
+    "contact-guard: no FORM_GUARD_SECRET or RESEND_API_KEY set — the contact form is UNPROTECTED"
+  );
+}
+
+export const contactGuard = secret
+  ? createContactGuard({
+      secret,
+      binding: "threatcrush:contact",
+      brandTerms: ["threatcrush", "threat crush"],
+      rateLimit: { max: 5, windowMs: 60 * 60 * 1000 },
+      // Set FORM_GUARD_ENFORCE=0 to score without blocking, if a real
+      // sender ever reports being turned away.
+      requireToken: process.env.FORM_GUARD_ENFORCE !== "0",
+    })
+  : null;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c25af17..5288ad8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -332,8 +332,8 @@ importers:
         specifier: ^0.1.1
         version: 0.1.1
       '@profullstack/stack':
-        specifier: ^0.1.3
-        version: 0.1.3(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
+        specifier: ^0.2.0
+        version: 0.2.0(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
       '@profullstack/x402-gateway':
         specifier: ^0.1.0
         version: 0.1.0
@@ -364,6 +364,9 @@ importers:
       resend:
         specifier: ^6.12.2
         version: 6.12.2
+      server-only:
+        specifier: ^0.0.1
+        version: 0.0.1
     devDependencies:
       '@tailwindcss/postcss':
         specifier: ^4
@@ -2845,6 +2848,10 @@ packages:
   '@profullstack/emailer@1.0.1':
     resolution: {integrity: sha512-/uhHJJGH+1xSSz3mJn6X+m6aruYjMD3JOaRp/d4R/YWlzpy07H9z0/JUleIyRyBPNmaANSIwjTZ7aVjaukOEpg==}
 
+  '@profullstack/form-guard@0.1.1':
+    resolution: {integrity: sha512-RGLGfQhjq40f+JqEhSmsJnS0I5sFWjYdrYx4VYtkUqz8xvioN2yyR+6uFK0mnDAStKrYytlngg3meUsrChm/OQ==}
+    engines: {node: '>=20'}
+
   '@profullstack/hqtui@0.1.9':
     resolution: {integrity: sha512-grOrw3KqbFTnjXKgMIa+HFiujVkdkEFScNSAnJ7GE/fGU6CVyowfw1wnKpFHt/Mv1A4n8QUTKJ3ws65tNKIvNg==}
     engines: {bun: '>=1.1', node: '>=22.6'}
@@ -2862,8 +2869,8 @@ packages:
       react:
         optional: true
 
-  '@profullstack/stack@0.1.3':
-    resolution: {integrity: sha512-NOseYE5cWMwH75/luUE46kJLyAd1xD+DSgGgwhxvgNMoJYfZ9W9vKmqdcGA/4Lgahzf7hWfjNvmLtVIzAqwhJw==}
+  '@profullstack/stack@0.2.0':
+    resolution: {integrity: sha512-4o7Bz58qyAOblgoIBpGiRNcAI9mS/JRheOtfdWxwv08iiPyWMdAQVe4Wrv0puiZAmJ9zI+JYjLUNpi0OdGY8yw==}
     engines: {node: '>=18'}
     peerDependencies:
       '@supabase/ssr': '>=0.5.0'
@@ -11288,6 +11295,8 @@ snapshots:
 
   '@profullstack/emailer@1.0.1': {}
 
+  '@profullstack/form-guard@0.1.1': {}
+
   '@profullstack/hqtui@0.1.9': {}
 
   '@profullstack/pluginstore@0.1.1': {}
@@ -11296,9 +11305,10 @@ snapshots:
     optionalDependencies:
       react: 19.2.4
 
-  '@profullstack/stack@0.1.3(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)':
+  '@profullstack/stack@0.2.0(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)':
     dependencies:
       '@profullstack/emailer': 1.0.1
+      '@profullstack/form-guard': 0.1.1
       '@profullstack/referrals': 0.1.0(react@19.2.4)
     optionalDependencies:
       next: 16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)