<story><title>Unverified.email</title><url>https://kerestey.net/writing/2020-04-05-announcing-unverified-dot-email.html</url></story><parent_chain><item><author>dylz</author><text>What kind of anti-abuse mechanisms do you have in play?&lt;p&gt;As soon as the API is figured out, it&amp;#x27;ll be used for mass spam signups. I&amp;#x27;ve done one of these before, and pretty much if you allow any form of being able to retrieve a code or URL or number from the body&amp;#x2F;subject, it&amp;#x27;ll be used for millions of spam signups.</text></item></parent_chain><comment><author>ryanbrunner</author><text>I think a relatively easy one, if the author was interested in securing this more, would be to strengthen the requirement around the &amp;quot;mailbox id&amp;quot;. Specifically require it in a single header, like how it&amp;#x27;s done in the example. That way, you could set up your own tests to match expectations, but it would be useless to use to abuse another third party (as the site that you&amp;#x27;re attempting to verify on certainly won&amp;#x27;t send that header).</text></comment>
<story><title>Unverified.email</title><url>https://kerestey.net/writing/2020-04-05-announcing-unverified-dot-email.html</url></story><parent_chain><item><author>dylz</author><text>What kind of anti-abuse mechanisms do you have in play?&lt;p&gt;As soon as the API is figured out, it&amp;#x27;ll be used for mass spam signups. I&amp;#x27;ve done one of these before, and pretty much if you allow any form of being able to retrieve a code or URL or number from the body&amp;#x2F;subject, it&amp;#x27;ll be used for millions of spam signups.</text></item></parent_chain><comment><author>derimagia</author><text>It&amp;#x27;s an alternative to mailhog or mailcatcher so no email is actually sent. It&amp;#x27;s just for testing sent emails.</text></comment>