The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 22, 2026 6:18am

PR Summary

Medium Risk
Touches authentication signup gates; behavior change is intentional but could block legitimate OTP-first signups when flags are set.

Overview
Closes a signup bypass where DISABLE_EMAIL_SIGNUP only blocked /sign-up/email, while better-auth’s email-OTP flow could still auto-create accounts for unknown emails on /sign-in/email-otp (skipping captcha and the normal sign-up path).

The same env flags are now wired into better-auth’s native disableSignUp on emailAndPassword (isEmailSignupDisabled) and emailOTP (isEmailSignupDisabled || isRegistrationDisabled), so direct API calls cannot bypass the UI gate. The redundant /sign-up/email path check in the auth before hook is removed in favor of the plugin-level enforcement.

With signup disabled, OTP sign-in for existing users is unchanged; unknown emails no longer get OTPs in an enumeration-safe way. Social/SSO registration is untouched.

^{Reviewed by Cursor Bugbot for commit ba91922. Configure here.}

Greptile Summary

This PR closes email signup paths that bypassed registration settings. The main changes are:

• Applies DISABLE_EMAIL_SIGNUP through Better Auth's native email/password signup control.
• Blocks email-OTP auto-registration when email signup or all registration is disabled.
• Removes the redundant path-based email signup check.

Confidence Score: 5/5

This looks safe to merge.

• The native email/password setting blocks direct email registration.
• The email-OTP setting covers unknown-user account creation under both registration flags.
• No blocking issue was found in the updated authentication path.

Important Files Changed

_{Reviews (2): Last reviewed commit: "fix(auth): also close otp auto-signup un..." | Re-trigger Greptile}

@greptile

@cursor review