https://shipreadyai.dev/learn/findings/o16-email-confirmation-info

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# New accounts are confirmed automatically

The public auth settings report that new sign ups are confirmed automatically, so an account can be created with an address the person does not own. You did not declare customer data, so this is recorded rather than raised.

## Why AI-built apps get this

Backend sign in settings default to whatever gets a first account created fastest. Open signup and automatic confirmation are the defaults that make the demo work, and they are still the defaults on the day the product goes public.

## Evidence line

the public auth settings report mailer_autoconfirm: true

## The fix

Turn email confirmation on before the app starts holding anything that belongs to a person.

## Prompt

Turn on email confirmation for new sign ups in the backend auth settings.