One more parallel to #6 on the free-tier side: treating "account just created" as proof they should get credits. Anyone can open another account with Gmail dots or a plus tag and look brand new. Key the credit grant on a normalised email in a separate trial_claims table with a unique index, and only grant when that insert lands. Same idea as deriving paid access from webhook-written rows rather than the success URL.
Thanks, that's a good parallel. A unique index on a normalised email makes the claim atomic, so two signups racing can't both win, and only granting credits when the insert lands is the key part. One addition: normalisation only goes so far (Gmail dots and plus tags are easy, but disposable domains aren't), so it's worth keeping the credit amount small or gating bigger grants behind a verified payment method.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
One more parallel to #6 on the free-tier side: treating "account just created" as proof they should get credits. Anyone can open another account with Gmail dots or a plus tag and look brand new. Key the credit grant on a normalised email in a separate trial_claims table with a unique index, and only grant when that insert lands. Same idea as deriving paid access from webhook-written rows rather than the success URL.
Thanks, that's a good parallel. A unique index on a normalised email makes the claim atomic, so two signups racing can't both win, and only granting credits when the insert lands is the key part. One addition: normalisation only goes so far (Gmail dots and plus tags are easy, but disposable domains aren't), so it's worth keeping the credit amount small or gating bigger grants behind a verified payment method.