84 Emails in One Night

Last night the Mail app on my Mac woke me. The subject line was always the same: “New message from Test”. Again. And again. Eighty-four times. This is the postmortem. All times are CEST. Quotes come from the saved emails and from commit 4c9c425. Time Event Wed 19, 19:52 One probe message arrives. The name is “Victorina Cable”. Thu 20, 21:26 The flood starts. Fri 21, 01:54 Seventy-seven messages later, the wave stops. Fri 21, 02:01–02:21 Six more messages slip through. Fri 21, 02:46 I push the fix, chore: update honeypot. Fri 21, 03:15 I go back to bed. This site is a static Hugo build on Vercel. Three forms POST to serverless functions: /api/contact/, /api/contact/feedback/, and /api/newsletter/subscribe/. Each function calls sendEmail() in api/_utils.js. That helper sends mail through my SMTP relay with nodemailer. The only defense was a honeypot field: 1<input type="url" name="website" tabindex="-1" autocomplete="off" 2 style="position: absolute; left: -9999px; opacity: 0;"…