You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Chrome autofill fills the registration honeypot, so real registrations are silently dropped #72
Chrome autofill fills the registration form's hidden honeypot field, so the server treats real applicants as bots and drops their registration while telling them it succeeded.
The problem
The honeypot is a hidden text input named company (REGISTRATION_HONEYPOT_FIELD in src/lib/registrations/schema.ts).
Chrome recognizes "company" as an address field and fills it from the visitor's saved address profile when they autofill the form. It ignores autoComplete="off" on such fields.
src/actions/public/submit-registration.ts returns { status: "success" } as soon as the honeypot has a value, before validating or saving anything.
Seen in a real applicant's network log: the request carried company filled with their employer from their autofill profile, the server answered success, and nothing was saved. They submitted several times from that Chrome, with no duplicate stored; only their attempt from another browser (no autofill profile) was saved.
Anyone whose Chrome autofill profile includes a company can lose their registration without knowing.
Expected
Autofill never fills the honeypot: give it a name and attributes no browser maps to an autofill field (not company, organization, website, url, name, email, phone, address words).
Check the contact form's honeypot (website, src/lib/contact/schema.ts) for the same problem.
Activity
Adel2411 commentedon Nov 6, 2026
Resolved by merged PR #78. Work is merged to dev.