feat: add honeypots and (mostly) invisible PoW captchas to highly spam prone forms by tefkah · Pull Request #3488 · knowledgefutures/pubpub

tefkah · 2026-02-19T18:04:07Z

Issue(s) Resolved

Test Plan

Screenshots (if applicable)

Optional

Notes/Context/Gotchas

Supporting Docs

Copilot

Pull request overview

This pull request implements a comprehensive anti-spam system for PubPub by adding honeypots and proof-of-work (PoW) captchas to highly spam-prone forms. The system uses the Altcha library for invisible PoW challenges and honeypot fields to catch automated bots.

Changes:

Added Altcha-based proof-of-work captcha system with server-side HMAC verification
Implemented honeypot fields across user-facing forms (signup, login, community/pub creation, discussions)
Enhanced spam tag tracking with honeypot triggers, manual markings, and automated status updates
Added comprehensive Slack and email notifications for spam events (new tags, bans, lifts)
Created UI components for spam management (SpamStatusMenu, user profile spam indicators)

Reviewed changes

Copilot reviewed 64 out of 68 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
server/utils/captcha.ts	New utility for Altcha PoW captcha verification with HMAC
server/utils/honeypot.ts	Honeypot detection and spam tag creation logic
server/spamTag/userQueries.ts	Enhanced user spam tag management with notifications and session deletion
server/spamTag/userDashboard.ts	New spam user dashboard queries with affiliation tracking
server/utils/slack.ts	Expanded Slack notifications for spam events (bans, lifts, new tags)
server/utils/email/spam.ts	Email notifications for spam bans and lifts to users and dev team
server/community/api.ts	Community creation with captcha/honeypot verification
server/pub/api.ts	Pub creation endpoints with spam protection
server/user/api.ts	User creation/update with captcha and honeypot checks
server/discussion/api.ts	Discussion creation with spam protection
server/threadComment/api.ts	Thread comment creation with spam protection
server/login/api.ts	Login endpoint with captcha verification
server/signup/api.ts	Signup with captcha and honeypot protection
server/captcha/api.ts	Challenge generation endpoint for Altcha
client/components/Altcha/Altcha.tsx	React component for Altcha widget integration
client/components/Honeypot/Honeypot.tsx	Hidden honeypot field component with dev mode visibility
client/components/SpamStatusMenu/SpamStatusMenu.tsx	UI for managing spam status of users
client/containers/User/UserHeader.tsx	Display spam status badges for super admins
types/spam.ts	New type definitions for honeypot triggers and user spam tag fields
utils/api/schemas/community.ts	Schema updates for captcha/honeypot fields
utils/api/contracts/pub.ts	New createFromForm endpoint contract
utils/api/contracts/auth.ts	New loginFromForm endpoint contract
package.json	Added altcha and altcha-lib dependencies
.test/setup-env.js	Added BYPASS_CAPTCHA=true for tests

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-26T17:19:28Z

client/components/Altcha/Altcha.tsx

+		if (!w) return;
+		const handleStateChange = (ev: Event) => {
+			const e = ev as CustomEvent<{ payload?: string; state: string }>;
+			console.log('state changed', e.detail);


The console.log statement should be removed before merging to production. Debug logging statements can add unnecessary noise to production logs and may expose implementation details about the captcha state machine.

Suggested change

console.log('state changed', e.detail);

Copilot · 2026-02-26T17:19:29Z

server/community/queries.ts

+			accentColorLight: inputValues.accentColorLight ?? '#ffffff',
+			accentColorDark: inputValues.accentColorDark ?? '#000000',


The default values for accentColorLight and accentColorDark (white and black) may not provide good visual contrast or branding. Consider using more distinctive default colors that better represent PubPub's brand, or making these fields required in the schema to force users to make an intentional choice.

Copilot · 2026-02-26T17:19:29Z

server/community/api.ts

+			const subdomain = req.body.subdomain ?? 'community';
+			return {
+				body: `https://${subdomain}.pubpub.org`,
+				status: 201,
+			};


When the honeypot is triggered, the API returns a 201 success status with a fake community URL. While this is good security practice (it doesn't reveal to bots that they've been detected), the URL is constructed from user-provided input (req.body.subdomain) which could potentially be used to probe the system. Consider using a fixed fake subdomain or sanitizing this value before returning it.

Copilot · 2026-02-26T17:19:29Z

infra/docker-compose.dev.yml

        environment:
            NODE_ENV: development
            PORT: 3000
+            # disable this


The comment "# disable this" is unclear and provides no context about why IS_DUQDUQ should be disabled in development. Consider updating this to explain the rationale, e.g., "# Disable DuqDuq mode in dev to use standard PubPub behavior" or similar.

Suggested change

# disable this

# Disable DuqDuq mode in dev to use standard PubPub behavior

Copilot · 2026-02-26T17:19:29Z

client/components/GlobalControls/CreatePubButton.tsx

+				onStateChange={(state) => {
+					if (!isLoading) {
+						setIsLoading(true);
+					}
+					// 	@ts-ignore
+					if (state.detail.state === 'verified') {
+						setIsLoading(false);
+					}
+				}}


There's a logic issue with the loading state management. Lines 52-54 set isLoading to true whenever onStateChange fires and isLoading is false, but line 21 also sets it to true. This creates a race condition where the loading state might be incorrectly set. The onStateChange handler should only manage loading state for the captcha verification itself, not for the entire form submission. Consider removing the isLoading management from onStateChange or using separate state variables for captcha loading vs. form submission loading.

Copilot · 2026-02-26T17:19:30Z

server/captcha/api.ts

+router.get('/api/captcha/challenge', async (_req, res) => {
+	const hmacKey = getAltchaHmacKey();
+	const challenge = await createChallenge({
+		hmacKey,
+		maxNumber: MAX_NUMBER,
+	});
+	return res.json(challenge);
+});


The /api/captcha/challenge endpoint has no rate limiting. This could allow an attacker to generate unlimited challenge requests, potentially using up server resources or gathering information about the HMAC key through timing attacks. Consider adding rate limiting (e.g., 10 requests per IP per minute) to prevent abuse.

Copilot · 2026-02-26T17:19:30Z

client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx

+	const handlePostThreadComment = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('title') as string) ?? '';
 		setIsLoading(true);
-		const outputData = await apiFetch('/api/threadComment', {
-			method: 'POST',
-			body: JSON.stringify({
-				accessHash: locationData.query.access,
-				parentId: discussionData.id,
-				threadId: discussionData.thread.id,
-				pubId: pubData.id,
-				communityId: communityData.id,
-				content: getJSON(changeObject?.view),
-				text: getText(changeObject?.view) || '',
-				commentAccessHash: pubData.commentHash,
-				commenterName,
-			}),
-		});
-
-		updateLocalData('pub', {
-			discussions: pubData.discussions.map((disc) => {
-				if (disc.thread!.id === outputData.threadId) {
-					return {
-						...disc,
-						thread: {
-							...disc.thread,
-							comments: [...disc.thread!.comments, outputData],
-						},
-					};
-				}
-				return disc;
-			}),
-		});
-
-		if (isPubBottomInput) {
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			const outputData = await apiFetch('/api/threadComment/fromForm', {
+				method: 'POST',
+				body: JSON.stringify({
+					...postThreadCommentBody(),
+					_honeypot: honeypot,
+					altcha: altchaPayload,
+				}),
+			});
+			updateLocalData('pub', {
+				discussions: pubData.discussions.map((disc) => {
+					if (disc.thread!.id === outputData.threadId) {
+						return {
+							...disc,
+							thread: {
+								...disc.thread,
+								comments: [...disc.thread!.comments, outputData],
+							},
+						};
+					}
+					return disc;
+				}),
+			});
+		} finally {
 			setIsLoading(false);
-			setEditorKey(Date.now());
+			if (isPubBottomInput) setEditorKey(Date.now());
 		}
 	};

-	const handlePostDiscussion = async () => {
+	const handlePostDiscussion = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('title') as string) ?? '';
 		setIsLoading(true);
-		const initAnchorData = getLocalHighlightText(pubView, discussionData.id);
-		const outputData = await apiFetch('/api/discussions', {
-			method: 'POST',
-			body: JSON.stringify({
-				accessHash: locationData.query.access,
-				discussionId: discussionData.id,
-				pubId: pubData.id,
-				historyKey: historyData.currentKey,
-				communityId: communityData.id,
-				content: getJSON(changeObject?.view),
-				text: getText(changeObject?.view) || '',
-				initAnchorData,
-				visibilityAccess: pubData.isRelease ? 'public' : 'members',
-				commentAccessHash: pubData.commentHash,
-				commenterName,
-			}),
-		});
-		updateLocalData('pub', {
-			discussions: [...pubData.discussions, outputData],
-		});
-
-		if (isPubBottomInput) {
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			const outputData = await apiFetch('/api/discussions/fromForm', {
+				method: 'POST',
+				body: JSON.stringify({
+					...postDiscussionBody(),
+					_honeypot: honeypot,
+					altcha: altchaPayload,
+				}),
+			});
+			updateLocalData('pub', {
+				discussions: [...pubData.discussions, outputData],
+			});
+			if (!isPubBottomInput) convertLocalHighlightToDiscussion(pubView, outputData.id);
+		} finally {
 			setIsLoading(false);
-			setEditorKey(Date.now());
-		} else {
-			convertLocalHighlightToDiscussion(pubView, outputData.id);
+			if (isPubBottomInput) setEditorKey(Date.now());
 		}
 	};


The error handling is missing in the try-catch blocks for discussion and thread comment posting. If apiFetch throws an error (e.g., from failed captcha verification or honeypot detection), the error will not be caught or displayed to the user. Users will see an indefinite loading state with no feedback.

Consider adding error handling to show users when their submission fails, for example:

} catch (err) { console.error('Failed to post discussion:', err); // Show error to user via toast or state update } finally { setIsLoading(false);

Copilot · 2026-02-26T17:19:30Z

client/containers/UserCreate/UserCreate.tsx

-			body: JSON.stringify({
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			console.log('altchaPayload', altchaPayload);


The console.log statement should be removed before merging to production. Debug logging statements like this can expose sensitive data (the captcha payload) to the browser console and should not be present in production code.

Suggested change

console.log('altchaPayload', altchaPayload);

tefkah added 15 commits February 10, 2026 17:26

feat: allow blocking users

da876d7

feat: improve blocking users

174fffa

fix: lint, etc

5c9d2bd

feat: allow extra keywords to be added by env var

26dff7a

Merge branch 'master' into tfk/spam-superadminuser

aec4f86

fix: also stop showing user comment

1abb43d

chore: merge

396f6bd

fix: lint

ab023fc

fix: lint, fr

7843395

feat: captchas and honeypots

d75a949

feat: improved captchas and honeypots

36f22c8

fix: lint

3715229

fix: send slack message on ban/unban

31b9f95

fix: skip captchas in test

f7eab42

fix

e7f7c42

tefkah mentioned this pull request Feb 23, 2026

reduce legacy spam #3322

Open

5 tasks

Merge branch 'main' into tfk/captcha-honeypot

0428725

tefkah changed the title ~~Tfk/captcha honeypot~~ feat: add honeypots and (mostly) invisible PoW captchas to highly spam prone forms Feb 25, 2026

tefkah added 4 commits February 25, 2026 19:19

fix: typecheck

5cf9d94

Merge branch 'main' into tfk/captcha-honeypot

09ed4bf

fix: allow superadmins to instaban from comments

d23b55d

fix: improve messages

6127ddb

tefkah requested a review from Copilot February 26, 2026 17:14

Copilot started reviewing on behalf of tefkah February 26, 2026 17:14 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add honeypots and (mostly) invisible PoW captchas to highly spam prone forms#3488

feat: add honeypots and (mostly) invisible PoW captchas to highly spam prone forms#3488
tefkah wants to merge 20 commits intomainfrom
tfk/captcha-honeypot

tefkah commented Feb 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		accentColorLight: inputValues.accentColorLight ?? '#ffffff',
		accentColorDark: inputValues.accentColorDark ?? '#000000',

	# disable this
	# Disable DuqDuq mode in dev to use standard PubPub behavior

Conversation

tefkah commented Feb 19, 2026

Issue(s) Resolved

Test Plan

Screenshots (if applicable)

Optional

Notes/Context/Gotchas

Supporting Docs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants