CAPTCHA, honeypot, or rate limiting applied to all submission forms

An unprotected submission form is an automated spam target. Bots discover open endpoints within hours of launch and flood moderation queues with hundreds of fake listings per minute. Without CAPTCHA, a honeypot field, or server-side rate limiting, your moderators are overwhelmed, storage costs spike, and legitimate submissions get buried. CWE-799 (Improper Control of Interaction Frequency) and OWASP A07 (Identification & Authentication Failures) both apply — the server cannot distinguish human from bot because it never asks.

Add at least one server-validated anti-spam layer. Honeypot is zero-friction for real users; CAPTCHA provides stronger bot detection. For a honeypot in a Next.js form:

{/* Hidden from real users via CSS, filled by bots */}
<input name="website_url" style={{ display: 'none' }} tabIndex={-1} autoComplete="off" />

// Server: reject if honeypot field is populated
const { website_url, ...data } = await req.json()
if (website_url) {
  return Response.json({ error: 'Submission rejected' }, { status: 400 })
}

For higher-volume directories, pair this with IP-based rate limiting (e.g., max 5 submissions per 60 seconds via Upstash Redis) so bot farms that rotate IPs still hit friction.