# CAPTCHA or rate limiting prevents bot posts

- **Pattern:** `ab-000705` (`community-moderation-safety.spam-prevention.bot-prevention`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000705
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000705)

## Why it matters

Without bot prevention, a single automated script can flood a community with thousands of posts per hour — overwhelming moderation queues, degrading feed quality, and inflating engagement metrics used to make product decisions. CWE-799 (Improper Control of Interaction Frequency) applies when there is no rate limiting or CAPTCHA on submission endpoints. OWASP A04:2021 (Insecure Design) frames the architectural gap: a platform designed without a bot prevention layer cannot be made safe by patching individual bugs. Bot floods are also the primary vector for coordinated inauthentic behavior, platform manipulation, and spam-link injection.

## Severity rationale

High because unprotected submission endpoints let bots flood content at machine speed, overwhelming moderation capacity and degrading community quality faster than humans can respond.

## Remediation

Apply rate limiting to every public-facing submission endpoint. Configure in `src/middleware/rateLimiter.ts`:

```typescript
import rateLimit from 'express-rate-limit';

export const postLimiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 10,             // 10 posts per minute per IP
  keyGenerator: (req) => req.ip,
  message: 'Too many submissions. Try again shortly.',
});

// Apply to all content routes
app.post('/api/posts', postLimiter, authenticate, createPost);
app.post('/api/comments', postLimiter, authenticate, createComment);
```

For higher-risk surfaces (public posting without auth), add hCaptcha or reCAPTCHA v3. A rate limit above 100 requests per minute does not satisfy this check as meaningful bot prevention.

## Detection

- **ID:** `bot-prevention`
- **Severity:** `high`
- **What to look for:** Check if post/comment submission forms use CAPTCHA (reCAPTCHA, hCaptcha), or if there's rate limiting on the submit endpoint. Look for IP-based or user-based rate limiting.
- **Pass criteria:** New accounts or unverified users face CAPTCHA on post submission, OR all submissions are rate-limited to no more than 10 posts per minute per-IP or per-user. Count all public-facing submission endpoints and verify each has at least 1 bot-prevention mechanism.
- **Fail criteria:** No CAPTCHA and no rate limiting. Bots can post freely without verification. Rate limits above 100 requests per minute do not count as meaningful bot prevention.
- **Skip (N/A) when:** Never — bot prevention is essential.
- **Detail on fail:** `"No CAPTCHA or rate limiting on post submission. Bots can flood the platform with posts."`
- **Cross-reference:** Compare with `community-moderation-safety.spam-prevention.account-age-limit` — bot prevention blocks automated abuse while account-age-limit throttles new human accounts.
- **Remediation:** Add CAPTCHA (reCAPTCHA or hCaptcha) to post submission forms. Configure in `src/middleware/rateLimiter.ts`:

  ```javascript
  import rateLimit from 'express-rate-limit';
  export const postLimiter = rateLimit({
    windowMs: 60 * 1000, // 1 minute
    max: 10,
    keyGenerator: (req) => req.ip,
    message: 'Too many submissions. Try again shortly.'
  });
  ```

## External references

- cwe CWE-799
- owasp A04

Taxons: access-control, cost-efficiency

HTML version: https://auditbuffet.com/patterns/ab-000705