True, but we raised the issue also that we needed to solve the dynamic alias name+@gmail for example, along with the free email providers @mailinator, all of th

True, but we raised the issue also that we needed to solve the dynamic alias name+@gmail for example, along with the free email providers @mailinator, all of this got rejected as a single feature. So yes just blocking dups on it’s own is trivial, it was wrapped in an epic around some other points. But I want to echo that your comment is accurate, maybe not 10 minutes, but it’s a rounding mistake worth of time on it’s own. The results got emailed as soon as POST so we didn’t keep a db along side the app. Keeping the list of used emails would have been easy but it would mean keeping a log/db/redis/flat file somewhere. That ends up eating a little more time. I think what we have illustrated here is exactly what happens in the bigger hacks. “Why didn’t they just... it takes 20 minutes to do that” and yes it does but it was packaged probably with other things that got killed.