> I didn't add any restrictions on email registration […] Exposing web services to the public internet without auth seems scary Aren’t you still effectively do

> I didn't add any restrictions on email registration […] Exposing web services to the public internet without auth seems scary Aren’t you still effectively doing that, though? This seems like the combination of two downsides: Bots will be able to perform email verification if they want to; honest users will still be deterred.