Your anti-bot check only binds the clients that opt into it
Our signup endpoint was used as an email relay. The honeypot that fixed it only ran on clients that sent the fields, and our own app sent none of them.
/9 min read / ai-agentssecurityarchitectureapi-design