A spam sign-up attack on a hobby app analysed with Claude Code
After 5,474 fake accounts flooded a personal GTD app overnight, Claude Code analysed the logs, mapped the attack and helped add basic defences.
Credits
Earliest dated source:
The full story
The maker built a personal GTD app, an OmniFocus-style task system, with Claude Code for themselves and a few friends. Overnight, a script hammered the unprotected sign-up and inbox endpoints, taking it from 38 users to 5,512 and the database from 400KB to 12MB in about four and a half hours. There was no rate limiting, captcha or email verification, which they call a "classic beginner mistake".
They gave Claude Code the logs, data patterns and API structure. It mapped the attack, helped design a threat model and suggested fixes they put in, including flagging suspicious accounts rather than deleting them and rate limiting registration.
How it was done
Tools
Themes
Loading themes…
Sources
From a short post by the maker, so the details are as they tell them.
- Reddit: Woke up to 5,474 users: An accidental security lessonReddit poster: femtowinPosted
The maker's post on r/SideProject.
If it disappears: archived copy of Reddit: Woke up to 5,474 users: An accidental security lesson (opens in a new tab)
- The project: gtd.nebulame.com
Linked in the post.