We sell bot detection. Last night I opened our database and found 555 pages of fake signups. This is the honest write-up: what broke, why it's embarrassing, how we fixed it in one night — and the accidental circuit breaker that saved our email domain.
The discovery
Tuesday, 11pm. I open the Supabase table editor to check something unrelated and the developers table feels… heavy. Every row has the same name: "🎁 Dene Hemen! 5K Lira Bonusunu Yakala" — Turkish for "Try it now! Grab the 5,000 Lira bonus." Casino spam. I scroll. Page 2. Page 40. Page 555.
REAL ACCOUNTS (OUCH)
Yes you read the third number right. We're early. For a few minutes our growth chart looked incredible, as long as you didn't read the names. The irony was not lost on me: bots flooded the signup form of a bot-detection product.
