From 58ddf9ab48787e86b31bff502867698305f3220f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 7 Sep 2026 00:26:36 +0000
Subject: [PATCH] feat(contact): turn anti-spam back on for the hire form

The route had anti-spam switched off outright (`honeypot: false`) with
nothing in its place, so /api/contact accepted anything anyone sent it.

The honeypot is back on and, unlike several sibling repos, the field is
actually rendered so it can fire. On its own that still misses the common
case: contact-form spam POSTs straight at /api/contact without loading
the page, which leaves a hidden field absent from the body rather than
filled, and the check passes.

So this also bumps @profullstack/stack to 0.2.0 and passes its new
`guard`. The hire page mints a signed token at render time and the route
requires it back, so a request that never loaded the form has nothing to
present. The token carries its issue time, giving a fill-time floor, and
the guard adds a per-IP rate limit.

The guard runs before field validation on purpose, so a bot that gets a
response has not learned which fields the route wants.

/hire becomes force-dynamic, since a cached page would hand every visitor
the same dead token. Nothing else changes render mode.

Content scoring only tags: a suspicious message still arrives and is
still persisted, with [spam? N] in the subject and a provenance block
naming the sender's IP, user-agent, fill time and the signals that fired.
It can never drop one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H5K2AxX2QZ98JW1Exe5wup
---
 apps/web/package.json                 |  5 ++--
 apps/web/src/app/api/contact/route.ts |  8 +++++-
 apps/web/src/app/hire/page.tsx        | 16 +++++++++--
 apps/web/src/components/HireForm.tsx  | 32 ++++++++++++++++++++-
 apps/web/src/lib/contact-guard.ts     | 41 +++++++++++++++++++++++++++
 pnpm-lock.yaml                        | 20 +++++++++----
 6 files changed, 111 insertions(+), 11 deletions(-)
 create mode 100644 apps/web/src/lib/contact-guard.ts

diff --git a/apps/web/package.json b/apps/web/package.json
index e1a7950..93ff1c4 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -12,7 +12,7 @@
     "@iarna/toml": "^2.2.5",
     "@profullstack/autoblog": "github:profullstack/autoblog#v0.4.0",
     "@profullstack/pluginstore": "^0.1.1",
-    "@profullstack/stack": "^0.1.3",
+    "@profullstack/stack": "^0.2.0",
     "@profullstack/x402-gateway": "^0.1.0",
     "@supabase/supabase-js": "^2.101.1",
     "@threatcrush/scan": "workspace:*",
@@ -22,7 +22,8 @@
     "qrcode.react": "^4.2.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "resend": "^6.12.2"
+    "resend": "^6.12.2",
+    "server-only": "^0.0.1"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
diff --git a/apps/web/src/app/api/contact/route.ts b/apps/web/src/app/api/contact/route.ts
index 0b993f6..6f7a306 100644
--- a/apps/web/src/app/api/contact/route.ts
+++ b/apps/web/src/app/api/contact/route.ts
@@ -1,4 +1,5 @@
 import { createContactRoute } from "@profullstack/stack/email";
+import { contactGuard } from "@/lib/contact-guard";
 import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 
 let supabase: SupabaseClient | undefined;
@@ -40,7 +41,12 @@ function messageWithExtras(s: {
 export const POST = createContactRoute({
   from: "ThreatCrush <hello@threatcrush.com>",
   to: "hello@threatcrush.com",
-  honeypot: false,
+  // Was `false`, with nothing in its place. The field is rendered now, so
+  // it can actually fire.
+  honeypot: "website",
+  // Requires a token minted when the form rendered. Runs before field
+  // validation, so a bot never learns which fields the route wants.
+  guard: contactGuard ?? undefined,
   fieldLabels: FIELD_LABELS,
   subject: (s) =>
     `[ThreatCrush] New ${s.fields.topic ?? "general"} inquiry from ${s.name}`,
diff --git a/apps/web/src/app/hire/page.tsx b/apps/web/src/app/hire/page.tsx
index 101bf9f..1736361 100644
--- a/apps/web/src/app/hire/page.tsx
+++ b/apps/web/src/app/hire/page.tsx
@@ -1,6 +1,7 @@
 import type { Metadata } from "next";
 import { SITE_URL } from "@/lib/blog";
 import { HireForm } from "@/components/HireForm";
+import { contactGuard } from "@/lib/contact-guard";
 
 export const metadata: Metadata = {
   title: "Hire Us — human-led security assessments",
@@ -88,7 +89,14 @@ const steps = [
   },
 ];
 
-export default function HirePage() {
+// The hire form carries a token minted at render time, so this page must
+// not be cached. A stale page would hand every visitor the same dead token.
+export const dynamic = "force-dynamic";
+
+export default async function HirePage() {
+  const token = contactGuard ? await contactGuard.issue() : null;
+  const guardFields = token ? contactGuard!.fields(token) : null;
+
   return (
     <div className="min-h-screen bg-tc-darker pt-24 pb-20">
       <script
@@ -182,7 +190,11 @@ export default function HirePage() {
             usually the same business day.
           </p>
           <div className="mt-6">
-            <HireForm />
+            <HireForm
+              token={token}
+              tokenName={guardFields?.token.name ?? null}
+              honeypotName={guardFields?.honeypot.name ?? null}
+            />
           </div>
         </section>
       </main>
diff --git a/apps/web/src/components/HireForm.tsx b/apps/web/src/components/HireForm.tsx
index 38dc0c4..48922dc 100644
--- a/apps/web/src/components/HireForm.tsx
+++ b/apps/web/src/components/HireForm.tsx
@@ -11,7 +11,16 @@ const labelClass = "block text-sm font-medium text-tc-text-dim mb-1.5";
 // Posts to the shared /api/contact route with topic "hire"; the extra fields
 // (target, stack, timeline) ride along as labelled rows in the notification
 // email and are appended to the persisted message.
-export function HireForm() {
+export function HireForm({
+  token,
+  tokenName,
+  honeypotName,
+}: {
+  /** Minted by the page at render time; proves the form was loaded. */
+  token: string | null;
+  tokenName: string | null;
+  honeypotName: string | null;
+}) {
   const [name, setName] = useState("");
   const [email, setEmail] = useState("");
   const [company, setCompany] = useState("");
@@ -20,6 +29,8 @@ export function HireForm() {
   const [timeline, setTimeline] = useState("");
   const [message, setMessage] = useState("");
   const [status, setStatus] = useState<Status>("idle");
+  // Honeypot. Nothing visible sets this, so anything in it came from a bot.
+  const [honeypot, setHoneypot] = useState("");
   const [error, setError] = useState("");
 
   const handleSubmit = useCallback(
@@ -41,6 +52,8 @@ export function HireForm() {
             timeline,
             message,
             topic: "hire",
+            ...(tokenName && token ? { [tokenName]: token } : {}),
+            ...(honeypotName ? { [honeypotName]: honeypot } : {}),
           }),
         });
 
@@ -91,6 +104,23 @@ export function HireForm() {
           </div>
         ) : (
           <form onSubmit={handleSubmit} className="space-y-4">
+            {/* Honeypot. Off-canvas rather than display:none, because some
+                bots skip fields they can tell are not rendered. */}
+            {honeypotName && (
+              <div aria-hidden="true" className="absolute -left-[9999px] h-px w-px overflow-hidden">
+                <label>
+                  Website
+                  <input
+                    type="text"
+                    name={honeypotName}
+                    value={honeypot}
+                    onChange={(e) => setHoneypot(e.target.value)}
+                    tabIndex={-1}
+                    autoComplete="off"
+                  />
+                </label>
+              </div>
+            )}
             <div className="grid gap-4 sm:grid-cols-2">
               <div>
                 <label htmlFor="hire-name" className={labelClass}>
diff --git a/apps/web/src/lib/contact-guard.ts b/apps/web/src/lib/contact-guard.ts
new file mode 100644
index 0000000..2c6dce1
--- /dev/null
+++ b/apps/web/src/lib/contact-guard.ts
@@ -0,0 +1,41 @@
+import "server-only";
+import { createContactGuard } from "@profullstack/stack/email";
+
+/**
+ * Shared guard for the public contact form.
+ *
+ * The page mints a token when it renders; the route verifies one when the
+ * form comes back. Both import this instance, because a `binding` or
+ * field-name mismatch between them would reject every real submission
+ * without saying so.
+ *
+ * This route had anti-spam switched off entirely (`honeypot: false`) and
+ * nothing in its place. The honeypot is back on and now actually rendered,
+ * but on its own it would still miss the common case: contact-form spam
+ * POSTs straight at /api/contact without loading the page, which leaves a
+ * hidden field absent from the body rather than filled. The token is the
+ * part a request that skipped the page cannot produce.
+ *
+ * The secret never reaches the browser, only the signature does. It has to
+ * be identical across every instance serving the form, so it falls back to
+ * RESEND_API_KEY, which sending already cannot work without.
+ */
+const secret = process.env.FORM_GUARD_SECRET ?? process.env.RESEND_API_KEY ?? "";
+
+if (!secret) {
+  console.warn(
+    "contact-guard: no FORM_GUARD_SECRET or RESEND_API_KEY set — the contact form is UNPROTECTED"
+  );
+}
+
+export const contactGuard = secret
+  ? createContactGuard({
+      secret,
+      binding: "threatcrush:contact",
+      brandTerms: ["threatcrush", "threat crush"],
+      rateLimit: { max: 5, windowMs: 60 * 60 * 1000 },
+      // Set FORM_GUARD_ENFORCE=0 to score without blocking, if a real
+      // sender ever reports being turned away.
+      requireToken: process.env.FORM_GUARD_ENFORCE !== "0",
+    })
+  : null;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c25af17..5288ad8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -332,8 +332,8 @@ importers:
         specifier: ^0.1.1
         version: 0.1.1
       '@profullstack/stack':
-        specifier: ^0.1.3
-        version: 0.1.3(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
+        specifier: ^0.2.0
+        version: 0.2.0(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
       '@profullstack/x402-gateway':
         specifier: ^0.1.0
         version: 0.1.0
@@ -364,6 +364,9 @@ importers:
       resend:
         specifier: ^6.12.2
         version: 6.12.2
+      server-only:
+        specifier: ^0.0.1
+        version: 0.0.1
     devDependencies:
       '@tailwindcss/postcss':
         specifier: ^4
@@ -2845,6 +2848,10 @@ packages:
   '@profullstack/emailer@1.0.1':
     resolution: {integrity: sha512-/uhHJJGH+1xSSz3mJn6X+m6aruYjMD3JOaRp/d4R/YWlzpy07H9z0/JUleIyRyBPNmaANSIwjTZ7aVjaukOEpg==}
 
+  '@profullstack/form-guard@0.1.1':
+    resolution: {integrity: sha512-RGLGfQhjq40f+JqEhSmsJnS0I5sFWjYdrYx4VYtkUqz8xvioN2yyR+6uFK0mnDAStKrYytlngg3meUsrChm/OQ==}
+    engines: {node: '>=20'}
+
   '@profullstack/hqtui@0.1.9':
     resolution: {integrity: sha512-grOrw3KqbFTnjXKgMIa+HFiujVkdkEFScNSAnJ7GE/fGU6CVyowfw1wnKpFHt/Mv1A4n8QUTKJ3ws65tNKIvNg==}
     engines: {bun: '>=1.1', node: '>=22.6'}
@@ -2862,8 +2869,8 @@ packages:
       react:
         optional: true
 
-  '@profullstack/stack@0.1.3':
-    resolution: {integrity: sha512-NOseYE5cWMwH75/luUE46kJLyAd1xD+DSgGgwhxvgNMoJYfZ9W9vKmqdcGA/4Lgahzf7hWfjNvmLtVIzAqwhJw==}
+  '@profullstack/stack@0.2.0':
+    resolution: {integrity: sha512-4o7Bz58qyAOblgoIBpGiRNcAI9mS/JRheOtfdWxwv08iiPyWMdAQVe4Wrv0puiZAmJ9zI+JYjLUNpi0OdGY8yw==}
     engines: {node: '>=18'}
     peerDependencies:
       '@supabase/ssr': '>=0.5.0'
@@ -11288,6 +11295,8 @@ snapshots:
 
   '@profullstack/emailer@1.0.1': {}
 
+  '@profullstack/form-guard@0.1.1': {}
+
   '@profullstack/hqtui@0.1.9': {}
 
   '@profullstack/pluginstore@0.1.1': {}
@@ -11296,9 +11305,10 @@ snapshots:
     optionalDependencies:
       react: 19.2.4
 
-  '@profullstack/stack@0.1.3(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)':
+  '@profullstack/stack@0.2.0(next@16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)':
     dependencies:
       '@profullstack/emailer': 1.0.1
+      '@profullstack/form-guard': 0.1.1
       '@profullstack/referrals': 0.1.0(react@19.2.4)
     optionalDependencies:
       next: 16.2.2(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)