Abuse protection

How the protections fit

Every protection here is on every plan, Free included: abuse protection is part of the product, not an upsell. They’re layered so no single check has to catch everything, and built so real users rarely notice: challenges are rare, accessible, and never reveal whether an account exists. A false positive always leaves a way in, a harder challenge or a passkey, never a dead end.

Telling people from bots

Every Continue and every sign-up runs an invisible proof-of-work check: the browser solves a small puzzle and the server verifies it. It’s HonkIO’s own, self-hosted check. No third-party CAPTCHA is used, and no visitor data goes to a third party.

Each attempt is scored for risk: request rates per IP address, network block and network provider; datacenter, Tor and proxy addresses; automation markers; recent failures; and how many apps the identifier or IP has hit. High risk gets a harder puzzle and an interactive challenge, with an audio option, in English and French. Very high risk is refused with the same wording as everything else.

Fake and throwaway sign-ups

• Throwaway email providers are blocked by default, from a maintained open-source list (block_throwaway_emails).
• Optionally, treat email aliases as one address, so a.b+x@gmail.com is ab@gmail.com (aliases_are_same, off by default because some people rely on aliases).
• Non-mobile numbers are refused. On Pro and Business you can also block VoIP numbers (block_voip).
• Per-app blocklists: email addresses, email domains, phone numbers or prefixes, IP addresses or ranges, network providers, and countries (by IP).
• Users flagged as likely bots don’t count toward your plan, and you can delete them in bulk, so a bot flood can’t use up your plan or run up per-user charges.

Volume limits

Fixed platform limits apply on top of the bot check: per recipient across all of HonkIO, so nobody’s inbox or phone can be flooded through many apps; per app, from the app’s own normal traffic; and per IP address, network block and network provider. A Free app on a new HonkIO account starts with low daily caps that rise as the account ages. The dashboard shows when a limit is hit.

Text-message fraud

Texts cost you money, so text sign-in has extra guards. It sends only to Canadian mobile numbers, only after the bot check passes, and through every protection of /v1/verify.

Each app has a daily text spending limit, sms_daily_limit_cents, $5.00 by default. When it’s hit, text sign-in pauses while email and passkeys keep working. You’re alerted at 50%, 80% and 100%, and sms.spend_limit_reached fires.

Pumping patterns (many texts to numbers in one exchange, codes sent but rarely entered, bursts from a few IP ranges) pause texts for the app or number range and alert you and HonkIO staff.

Attack mode

When an app’s sign-up or code rate jumps well above its normal level, HonkIO switches it into attack mode: every visitor gets the interactive challenge, limits tighten and text sign-in pauses. You’re told by email, a dashboard banner and app.attack_mode.started. Attack mode ends on its own once traffic is back to normal (app.attack_mode.ended). Turn it on or off by hand at any time with attack_mode: on, off or auto.

Account takeover

• Code lockouts, and codes and links that only finish sign-in in the browser that asked for them (Sign-in methods).
• New-device alerts: a sign-in from a browser the user hasn’t used before sends them a “new sign-in” message with a “This wasn’t me” link, which ends all their sessions and makes them re-verify every sign-in method. On by default (new_device_alerts). A first-party, host-only device cookie on your sign-in hostname recognizes returning browsers; there’s no invasive fingerprinting.
• A risky sign-in from a new device asks for a second check when the user has one: a passkey, or the channel they didn’t sign in with (email, on Free). Users with only one method are let through, and the sign-in is flagged in their history.
• After a code sign-in, the page offers to save a passkey, the strongest defence. You can’t turn this prompt off.

The Security tab and API

Each app’s Security tab shows live and recent counts of sign-ins, failures, challenges shown, blocked sign-ups, texts by number range and attack-mode periods, with the reason for each block, plus each user’s sign-in history.

Every setting on this page is also in the API (/v1/auth-apps/:id/security, API reference), and the events have webhooks: user.locked, signin.suspicious, signup.blocked (counts, at most once a minute), app.attack_mode.started, app.attack_mode.ended and sms.spend_limit_reached (webhook events).

Privacy of abuse data

IP addresses, network data, device cookies and risk scores are stored in Canada with the rest of your app’s data, kept for 90 days, then deleted or reduced to aggregate counts. They’re never sold, shared, or sent to third-party scoring services. The network lists and the throwaway-email list are public data that HonkIO pulls in; nothing about your visitors goes out.