Back to Business ModeEmail
Signup
Account creation looks simple, but it's where weak-password acceptance, throwaway emails, and bot farms all try to slip in before any other control exists.
Password strength is enforced before an account is ever created, not after
Disposable/throwaway email domains are blocked so accounts can be recovered and trusted
Every new account must prove ownership of the email before it can do anything
Automated signup floods are throttled at the edge before they reach the application
Hands-on demo
https://app.flowground.dev/signup
Bot Registration Flood
Simulate a script firing rapid signup requests from a single origin, and watch Cloudflare's edge rate limiting step in before the application server ever sees the traffic.
req #1
req #2
req #3
req #4
req #5
req #6
req #7
req #8
req #9
req #10
req #11
req #12
Try it yourself
Try it yourself — run a scenario below, then flip this and replay it to see what changes.
Weak Password Attempt
A password like "password1" looks fine to a human but is cracked instantly by automated tools.
Want this flow explained in detail as it plays?
app.flowground.dev/signup
Create your account
Password
password1
Selected hop
User submits the signup form
Applicant
The person creating a new account.
Signup Service
Handles new account creation and its associated checks.
What happens here
Email: [email protected] · Password: password1