[Security] Rate-limit, CAPTCHA and email-gate tenant registration (/register abuse)

[mindsers]

Summary

In multi-tenant mode, /register creates a full congregation (tenant) + admin user on POST with no CAPTCHA, no rate limiting, and no email-verification gate before provisioning (db.congregation.create runs immediately, then defaults/roles are seeded). An attacker can script unlimited congregation creation — DB/row growth, seeded default data per tenant, subdomain squatting, and outbound verification-email spam from the mail provider (reputation damage). Because each tenant provisions storage/DB structures, this is a cheap amplification/DoS and cost vector.

Affected code

• app/features/authentication/routes/register.tsx
• app/features/authentication/server/register-congregation.server.ts (~L20-74)

Remediation

• Add a CAPTCHA (Turnstile/hCaptcha) and per-IP rate limiting to /register.
• Require email verification before the tenant is fully provisioned/usable.
• Cap trials per IP/email domain; monitor creation rate.

Severity

Medium.

---

Source: internal security review (commit 0360e87, 2026-07-21).