https://shipreadyai.dev/learn/findings/o16-signup-open

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Anyone can create an account

The public auth settings at {endpoint} report that self signup is on, so a script can create accounts at will.

## Why AI-built apps get this

Backend sign in settings default to whatever gets a first account created fastest. Open signup and automatic confirmation are the defaults that make the demo work, and they are still the defaults on the day the product goes public.

## Evidence line

the public auth settings report mailer_autoconfirm: true

## The fix

Turn self signup off if the product is invite only, and put a rate limit in front of the signup route either way.

## Prompt

Turn off open self signup in the backend auth settings if the product is invite only, and rate limit the signup route.