The signup form was designed
for a person.
Somebody with a mouse,
reading the labels,
making one decision,
once.
That is not who is filling it in
any more.
An agent, acting for a customer
who never sees your screen.
A script a client wrote
because your interface
was slower than their spreadsheet.
An integration a partner built
against the only door
you left unlocked,
which was the website.
None of that is an attack.
That is demand,
arriving in a shape
your product was not drawn for.
Look at what you assumed.
Rate limits tuned to
how fast a human can click.
Six screens of state
held together by a session
that expects a browser.
A confirmation email
sitting in the middle of a flow
as though somebody is watching
an inbox.
Error messages written as sentences,
in a tone,
for a person who will read them.
Pagination that quietly assumes
nobody goes past page three.
Every one of those
is a statement about who your user is,
and you never wrote it down
because it was too obvious to say.
So say it now.
Decide, capability by capability,
whether something automated
is allowed to do this.
Write the answer somewhere,
because silence gets read as yes.
Then give them a real door.
A documented endpoint,
a token you can revoke,
a limit you set on purpose,
a version you can retire.
That costs less to run
than a hundred scripts
driving your interface sideways,
and it lets you see
who is actually out there.
Return errors something can branch on.
A code, not a paragraph.
Make the operations that matter
safe to repeat,
because a client that never gets tired
will retry at a speed
no person ever would.
Log the client
as well as the user.
The question used to be
what will people do with this.
The question now is
what will something do with this,
ten thousand times,
at four in the morning,
having never read the label.
– Serguey Asael Shinder
Top comments (0)