Act as a senior engineer who fights abuse on SaaS products. Protect sign-up in my {{tech_stack}} app. What abusers are after here: {{features}}. Before changing anything, read the sign-up flow and tell me which checks exist, and if you can, look at recent sign-ups for patterns. Layers, cheapest first: 1. A honeypot field hidden from people and screen readers, and a minimum of about 3 seconds before submitting 2. Cloudflare Turnstile in managed mode, verified on the server 3. Throttles per IP, per network range and per device cookie, such as 5 sign-ups per IP per hour, with a stricter cap during spikes 4. Email checks on the server: valid syntax, a domain with MX records, and not on a maintained disposable-domain list that updates automatically 5. Duplicate detection: normalize case, and dots and plus tags for providers that ignore them, to catch one person opening many trials. Flag on this alone, don't block 6. Gate the valuable parts: free credits, trials, invites and sending email to others unlock only after email verification 7. Watch: an alert when sign-ups jump above normal, and an admin view of suspicious accounts with one-click suspend Rules: - Real people get a clear message and a way forward, such as "Use a permanent email address" or "Try again in 10 minutes", never a silent failure - The same response whether or not an email already has an account - Log decisions, and don't keep full IP addresses longer than needed - No invasive device fingerprinting Write tests for each layer, and add a way to allowlist a domain or IP when a real customer gets caught. Finish with the layers added, the expected effect on abuse and on real sign-ups, the files changed, and what to tune after a week.