By Partly fixable yourself. CAPTCHA and rate limits are settings, plus a small code change.
What you see. Hundreds of accounts with random emails appear, your email quota is used up, and AI credits or storage get burned.
Why it happens
Your sign-up form talks to a public endpoint. Nothing stops a script from calling it a thousand times. AI-built apps ship with email confirmation off, no CAPTCHA, and the default rate limits, so every fake account becomes a real user who can trigger emails, create rows, upload files and call your AI features. A June 2026 scan of 127 AI-built apps found 71 percent had no rate limiting on auth endpoints.
Supabase gives you the tools, they are just not on. CAPTCHA with hCaptcha or Cloudflare Turnstile protects sign-up, sign-in and password reset once enabled under Bot and Abuse Protection, but the frontend must also pass a captchaToken. Rate limits default to 30 sign-up requests per 5 minutes per IP address and 30 anonymous sign-ins per hour. On Firebase, App Check only accepts requests that carry a valid token proving they came from your real app.
Fix it yourself
- In Supabase open Authentication, Providers, Email and turn on Confirm email, so unconfirmed accounts cannot use the app. Turn off anonymous sign-ins if you do not use them.
- Create an hCaptcha or Cloudflare Turnstile account. In Supabase open Authentication, Bot and Abuse Protection, enable CAPTCHA and paste the secret key.
- Ask your builder: Show the CAPTCHA widget on sign-up, sign-in and password reset and pass its captchaToken to every Supabase auth call. Without this step sign-ups will fail.
- Open Authentication, Rate Limits, and lower the sign-up limit per IP while the attack lasts. Raise the email limit only once CAPTCHA is live.
- On Firebase enable App Check with reCAPTCHA Enterprise for the web and enforce it for Authentication, Firestore and Storage.
- Clean up: export the list of fake accounts, delete them, and check which rows and files they created. Add per-user limits on AI and uploads, check COST-01.
When to get an engineer
Get an engineer when the fake accounts have already created data you must untangle, when sign-ups keep succeeding with CAPTCHA on, or when the app also lets anonymous visitors call paid APIs. Tell them when it started, how many accounts appeared, and which features each account can reach. A single fix is €99–$990, about two days, covering CAPTCHA wiring, rate limits, and the cleanup.
Top-rated companies for Supabase apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Check these
Sign-in and sign-up are rate limited
Without limits, bots create thousands of accounts and run up your email and AI bills.
Sign-up confirmation and password reset work end to end
Use a real inbox. Check that the link arrives, points to your live domain, and works once.
AI and paid API calls have per-user limits
Without a cap, one user or one bot loop can spend your monthly budget in an hour.
Access rules are on for every table
In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say allow read, write: if true.
Questions
Will CAPTCHA annoy real users?
Turnstile and hCaptcha mostly run invisibly and only challenge suspicious traffic. Losing a few seconds at sign-up is cheaper than a burned email quota.
Why are the bots hitting a tiny new app?
They are not choosing you. Scripts scan for any open sign-up form and any AI feature they can use for free.
Sources: Supabase: enable CAPTCHA protection; Supabase: auth rate limits; Firebase: App Check; Launch Ready Code: state of vibe code security, June 2026.