... tech stack. They were relying on popular "security" modules that simply changed the admin login URL to a custom path a classic case of security by obscurity. Spoiler: It didn't help at all. Judging by the logs, automated botnets had been hammering the server 24/7 for weeks. These bots don't care about custom admin URLs or what framework you use. They scan everything indiscriminately, probing REST APIs, flooding common gateways, and looking for zero-day vulnerabilities ...

... Appreciate the signal on rate limits, that's shipping before launch too. Comment from Mustafa Arian(@thenameisarian): good positioning. the unsexy moat for form backends is spam handling. once a public form is up, you get hammered by botnet submissions in the first 72 hours. the form backends that fail are the ones that did not ship rate limits, honeypots, and adaptive captcha by default. how are you handling that on the free tier? if you can offer a clean ... ... experience without forcing users to add hcaptcha themselves, you have a real differentiator vs