By Ronny Cruz Alvarez, founder of Open Feed Network (Candor Network). Solo founder, one production platform, a lot of opinions about what a rejection message is allowed to say.
The bug that convinced me
Two weeks ago, in the middle of building a registration-screening tool during the Fediverse's latest signup-spam wave, I found a bug in my own detection engine that taught me something I should have already known: a security system's output is an attack surface.
The engine — Sentinel, the perimeter-defense classifier behind everything I build — flags spam signup text using a bank of pattern matchers. Cryptocurrency pitches, generic templated openers, that kind of thing. When a pattern matched, the rejection reason returned to the caller looked something like this:
jsreason: spam phrase matched: /crypto|investment.{0,10}opportunity/i
