pmb fc965e3f17 Suspend immediately when both IP and email signals flag a signup ...

The hourly OR-based sweep (SUSPICIOUS_GRACE_HOURS) still handles a
single-signal flag as before. This adds an additional check in
process_signup(): a signup flagged by BOTH IP-scrutiny and
email-domain scrutiny at once is a stronger signal, so it's suspended
right away instead of waiting out the grace period, skipping the
hold/welcome path and the suspicious_watch entry entirely.

Gated behind new SUSPICIOUS_COMBINED_* env vars, dry-run first per the
usual rollout convention (unlike SUSPICIOUS_DRY_RUN, which shipped
live by design). Falls back to the normal held-welcome path if the
suspend API call fails, and respects ABUSE_ALLOWLIST.

2026-07-15 10:07:19 -07:00

..

main.py

Suspend immediately when both IP and email signals flag a signup

2026-07-15 10:07:19 -07:00

suspicious_sweep.py

Only log suspicious-sweep actions, not routine no-op skips/clears

2026-07-06 07:11:23 -07:00