The assistant and the contact form now turn away automated traffic

Automated traffic is turned away before it reaches the assistant

The assistant answers real questions and costs real money doing it, and the contact form sends real email. Both were reachable by anything that could speak HTTP. A script could post a message — or a thousand of them — and every one of them would be screened, answered, and delivered as though a person had asked. The site did ask visitors to prove they were people: the security check in the browser, before the message was sent. But that check was tied to the form, not to the traffic. A request that skipped the form entirely never met it.

That gap is closed. Vercel's BotID now classifies every request to the chat endpoint and the contact endpoint before either one reaches the screening model, the answer model, or the mail server. A request that looks automated is refused with a plain message. A request that looks like a person continues exactly as before.

Nothing changes for a visitor

BotID is invisible. There is no new checkbox, no puzzle, and nothing to solve. The browser attaches a challenge to the request the way it already attaches the security check, Vercel reads the result, and the conversation starts. A visitor who arrives through a link, a search, or a bookmark is not asked to do anything different than before, and the two protections are independent: the browser security check still stands on its own, and BotID still works if a visitor never sees that check at all.

The check is on the request, not the account

BotID judges each request as it arrives rather than clearing a visitor once and letting that clearance cover everything afterwards. That matters for the two endpoints where it applies, because each request is the thing that costs something: one chat turn is one screening call and one answer call, and one contact submission is a screening call, a refinement, and an email. A blocked request spends none of it. The public pages, the search engine crawlers, and the health check are deliberately left alone — this is aimed at the endpoints that spend money, not at the site as a whole.

Full technical detail is in the v0.6.3 release notes.