Email verification required for new accounts

Platforms without email verification allow spam accounts to be created and operational in seconds. CWE-306 (Missing Authentication for Critical Function) applies: posting is a critical function that should require verified identity. Without a verification gate, a single attacker can automate account creation and bypass per-account rate limits by rotating through throwaway emails. Email verification also enforces a basic contact point for ban notifications, password resets, and compliance communications — platforms without it lose the ability to reach users for any purpose.

Gate all content-creation endpoints behind an email verification check. Add a emailVerified boolean to your users table and enforce it at the API layer:

app.post('/api/posts', authenticate, async (req, res) => {
  const user = await db.users.findOneById(req.user.id);
  if (!user.emailVerified) {
    return res.status(403).json({ error: 'Please verify your email before posting.' });
  }
  // ... create post
});

On signup, generate a time-limited token (24-hour expiry), send it to the provided email, and set emailVerified = true only when the token is consumed. A verification email that is sent but never enforced as a gate does not satisfy this check.