Orisift

New write up: how free AI credits leak in Supabase and Next.js apps (repeat signups, an open generate route, credits before email confirmation, no rate limit) and the fix, with tested code. dev.to/elijahbrown/...

New on DEV: reject known throwaway domains at signup in Next.js without also blocking privacy aliases like SimpleLogin. dev.to/elijahbrown/...

Wrote up how we stop one person getting two free trials in Laravel. Normalise the email, then enforce it in the database. dev.to/elijahbrown/...

One free trial per person in Laravel: fold Gmail dots, plus tags and googlemail.com into one key, then claim the trial inside one DB::transaction with a unique index. elijahbrown.hashnode.dev/one-free-tri...

Before SMS OTP spend, reject fiction/TV reserved ranges. UK 020 7946 and NANP 555-01xx still pass isValid and still bill you. orisift.com/reserved-pho...

One trial per inbox in Supabase, enforced by Postgres. Gmail dots, plus tags and googlemail.com collapse to one claim key. Unique index plus ON CONFLICT DO NOTHING RETURNING keeps the credit grant and the claim in the same transaction. elijahbrown.hashnode.dev/one-trial-pe...

If signup SMS goes out before you screen the number, every disposable burns credit. Check phone and email first; only SMS numbers that already look usable. elijahbrown.hashnode.dev/sms-code-sig...

Node free-tier reuse: normalised Gmail key, unique trial_claims, grant in one transaction. Prisma, Drizzle, pg, sqlite, Next.js. Tests included. elijahbrown.hashnode.dev/stop-nodejs-...

Python free-tier reuse: normalised Gmail key, unique trial_claims row, one transaction so a second signup skips the credits. Django, SQLAlchemy, sqlite3 + race test: elijahbrown.hashnode.dev/stop-one-per...

Orisift is on Product Hunt today: signup screening for phone, email, IP and domain, a separate result per field with its evidence, and no combined score. Come and see, and tell me what you think: www.producthunt.com/products/ori...

Laravel free-tier reuse: normalise Gmail dots, plus tags and googlemail.com into one email key, keep E.164 phone key, grant credits only when both keys are new. elijahbrown.hashnode.dev/stop-one-per...

Tomorrow I'm putting Orisift on Product Hunt. It screens a signup's phone, email, IP and domain and returns a result per field with the evidence. Feedback on what it gets wrong is the most useful thing anyone can give me. Try it, no account: orisift.com/x?m=post&c=b...

One person, three free trials: j.doe+2@gmail.com, jdoe@googlemail.com, and a reformatted phone number. A Laravel walkthrough on normalising both into keys and claiming them in the same transaction as the credits. elijahbrown.hashnode.dev/stop-one-per...

If your signup form texts a code to any number typed in, someone can run up your SMS bill. I wrote up what helps: parse to E.164, only serve countries you need, refuse fictional ranges, and rate limit by prefix. Node and PHP code included. elijahbrown.hashnode.dev/sms-code-sig...

Privacy email aliases aren't the same as throwaway inboxes. Alias relays keep a durable inbox; throwaways don't. Blocking both costs signups you probably wanted. Notes on how Orisift separates them where classified: elijahbrown.hashnode.dev/privacy-alia...

If you block throwaway email domains from a list, pin it to a commit and check its hash. A list that updates under you can start refusing a domain people sign up with, with no change in your own code.

A DNS timeout is not an invalid email. Treat MX timeouts as inconclusive, not a hard reject. SERVFAIL and timeout differ from NXDOMAIN. I wrote this up: elijahbrown.hashnode.dev/dns-timeout-...

Not every 555 number is fictional. NANPA keeps only 555-0100 to 0199 for fiction, in any area code: +1 212 555 0123 is a placeholder, +1 212 555 0200 isn't. My free checker knows the difference: orisift.com/x?m=post&c=b...

Store phone numbers in E.164 and format only for display. // libphonenumber-js parsePhoneNumber('07700 900123', 'GB').number // '+447700900123' One canonical string makes duplicate checks simple. And 07700 900xxx is a UK range Ofcom keeps for drama, so a signup form should not accept it.

Orisift checks a signup's phone, email, IP and domain in one request and returns a separate result for each field. I built a Supabase Auth helper into @orisift/sdk, the Node SDK, so that check runs before the user is created. orisift.com/x?m=post&c=b...

A domain can publish a Null MX record (one MX record, priority 0, pointing at ".", RFC 7505) to say it accepts no email at all. A signup check that only asks whether an MX record exists will pass it. Treat Null MX as a firm no before you send the welcome email.

Gmail ignores dots before the @, so j.smith@gmail.com and jsmith@gmail.com reach the same inbox. That rule belongs to gmail.com and googlemail.com. On other domains a dot is a normal character, so if you strip dots to catch duplicate signups, do it only for those two domains.

I built a free checker on the Orisift homepage. Paste one phone number, email, IP or domain and it shows each finding with its source. Three previews a day, no account. orisift.com/x?m=post&c=b...