Glossary
Open signup
Whether anyone can create an account, and whether the address has to be proved.
What it means
Backends publish a small settings document so the sign in screen knows what to show: which providers are on, whether self signup is allowed, whether a new account is confirmed automatically. It is served to the browser by design, which means it can be read from outside.
Two values on it decide a lot. Self signup being on means a script can create accounts at whatever rate your limits allow. Automatic confirmation means an account can be created with an address the person does not own, which matters as soon as anything in your product is addressed by email.
Neither is wrong on its own. A consumer product wants open signup. An invite only tool does not, and shipped with the default because the default is what made the first test account work. A check reports the values as published and leaves the decision where it belongs.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026