https://shipreadyai.dev/learn/findings/o16-email-confirmation-off

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# New accounts are active before the address is confirmed

The public auth settings report that new sign ups are confirmed automatically, so an account can be created with an address the person does not own.

## Why AI-built apps get this

Backend sign in settings default to whatever gets a first account created fastest. Open signup and automatic confirmation are the defaults that make the demo work, and they are still the defaults on the day the product goes public.

## Evidence line

the public auth settings report mailer_autoconfirm: true

## The fix

Turn email confirmation on so an address has to be proved before the account works.

## Prompt

Turn on email confirmation for new sign ups in the backend auth settings.