Security

• CSRF token on every form
• Honeypot and minimum submit timing
• Per-module rate limiting
• Built-in session-bound single-use CAPTCHA
• Optional Cloudflare Turnstile
• Server-side required, email, URL, and upload validation
• Temporary upload cleanup after mail processing

Turnstile needs a site key and secret key in the module Security settings.