We Almost Told the Spam Bots How to Beat Us

Short summary

A solo founder discovered that his spam detection engine's rejection messages contained the exact regex patterns attackers could use to bypass the filter. He established a core invariant: detection logic and detection disclosure must be separate systems, with only generic categories exposed externally. The post also covers fail-to-queue behavior and applying the same engine to Fediverse registration screening during a spam wave.

• •Detection system output is an attack surface — rejection messages must not reveal specific patterns or thresholds
• •Internal audit detail and public-facing reasons must be different objects drawn from different vocabularies
• •Sentinel Signup uses fail-to-queue: on screening errors, flag for review rather than pass or block

Generated with AI, which can make mistakes.