The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stack-auth-hosted-components	Ready	Preview, Comment	Mar 23, 2026 3:04pm
stack-backend	Ready	Preview, Comment	Mar 23, 2026 3:04pm
stack-dashboard	Ready	Preview, Comment	Mar 23, 2026 3:04pm
stack-demo	Ready	Preview, Comment	Mar 23, 2026 3:04pm
stack-docs	Ready	Preview, Comment	Mar 23, 2026 3:04pm

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Greptile Summary

This documentation PR covers the Turnstile fraud protection integration shipped in #1239, touching three files: sign-up rules, the ServerUser SDK reference, and the self-host guide.

• sign-up-rules.mdx: Adds countryCode, riskScores.bot, and riskScores.free_trial_abuse to the available conditions table with accurate types and descriptions. Documents the in list-membership operator and numeric comparison operators. Adds three practical use-case examples (block high-risk bots, restrict by country, combined fraud signals). The condition variable names and CEL syntax are verified against the backend CEL evaluator. However, the tester's "Test inputs" and "Normalized context" subsections were not updated to mention the new countryCode and risk-score fields that the dashboard tester now accepts.
• user.mdx: Adds countryCode: string | null and riskScores: { signUp: { bot: number; freeTrialAbuse: number } } to the ServerUser type TOC and adds corresponding CollapsibleTypesSection entries. TypeScript types match the SDK implementation exactly.
• self-host.mdx: Adds a "Bot protection (Turnstile)" section documenting the three required Turnstile env vars plus three optional ones. All names and accepted values are verified against the backend source.

Confidence Score: 5/5

• Safe to merge; all documented field names, types, and env var values match the implementation. The only gap is the tester subsection not mentioning new inputs, which is a minor follow-up.
• All three files contain accurate information verified against the backend CEL evaluator, SDK types, and backend env-var handling. The single P2 comment (tester docs not updated for new inputs) is a polish item that doesn't affect correctness of the core documentation.
• No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Sign-up attempt] --> B[Cloudflare Turnstile challenge]
    B --> C{Challenge result}
    C -->|ok| D[Compute risk scores\nbot, free_trial_abuse]
    C -->|invalid / error| E{STACK_ALLOW_SIGN_UP_ON_\nVISIBLE_BOT_CHALLENGE_FAILURE?}
    E -->|true| D
    E -->|false| REJECT[Reject sign-up]

    D --> F[Detect country code\nvia proxy headers\nSTACK_TRUSTED_PROXY]
    F --> G[Build CEL context\nemail, emailDomain, authMethod,\noauthProvider, countryCode,\nriskScores.bot, riskScores.free_trial_abuse]
    G --> H[Evaluate sign-up rules\nin priority order]
    H --> I{First matching rule}
    I -->|Allow| ALLOW[Allow sign-up\nStore countryCode + riskScores\non ServerUser]
    I -->|Reject| REJECT
    I -->|Restrict| RESTRICT[Allow sign-up\nbut mark as restricted]
    I -->|Log| LOG[Log and continue\nto default action]
    I -->|No match| DEFAULT[Apply default action]

_{Reviews (1): Last reviewed commit: "Document Turnstile fraud protection and ..." | Re-trigger Greptile}