The Headless Scraper That Filled the Database with Garbage
The Headless Scraper That Filled the Database with Garbage
Your SaaS platform offers free team workspaces with a signup form containing standard fields: Full Name, Work Email, Company Name, and Password. Over the past three weeks, automated scraping scripts and lead-generation bots have created over 350,000 spam accounts, polluting the database and triggering thousands of fake outbound welcome emails that cause email providers to flag your domain for spam. The product manager refuses to put a disruptive visual CAPTCHA (like distorted text or puzzle sliders) on the signup page because signup conversion dropped by 18% during an earlier trial. A junior engineer adds an invisible HTML input (<input type="text" name="website" style="display: none;">) as a naive honeypot. Within days, sophisticated attackers using headless Chrome (Puppeteer/Playwright) inspect computed styles and the browser accessibility tree, detect that the element is hidden from viewport rendering, leave the field empty, and continue registering spam accounts at full volume. Furthermore, visually impaired users using assistive screen readers inadvertently fill in the hidden field, having their legitimate signups silently blocked. You are asked to architect an advanced honeypot and canary trap system that catches modern bots without harming accessibility or conversion.
The Headless Scraper That Filled the Database with Garbage
Your SaaS platform offers free team workspaces with a signup form containing standard fields: Full Name, Work Email, Company Name, and Password. Over the past three weeks, automated scraping scripts and lead-generation bots have created over 350,000 spam accounts, polluting the database and triggering thousands of fake outbound welcome emails that cause email providers to flag your domain for spam. The product manager refuses to put a disruptive visual CAPTCHA (like distorted text or puzzle sliders) on the signup page because signup conversion dropped by 18% during an earlier trial. A junior engineer adds an invisible HTML input (<input type="text" name="website" style="display: none;">) as a naive honeypot. Within days, sophisticated attackers using headless Chrome (Puppeteer/Playwright) inspect computed styles and the browser accessibility tree, detect that the element is hidden from viewport rendering, leave the field empty, and continue registering spam accounts at full volume. Furthermore, visually impaired users using assistive screen readers inadvertently fill in the hidden field, having their legitimate signups silently blocked. You are asked to architect an advanced honeypot and canary trap system that catches modern bots without harming accessibility or conversion.
Provide 1–2 precise sentences for each architectural dimension. Each box guides you on what staff-level interviewers evaluate.
Define SLA targets, hard consistency constraints, and conditions the system must never violate.
Quantify throughput (QPS/RPS), read:write ratios, and peak burst multipliers.
Step-by-step path: client ingress → API gateway → queues → background workers → persistence.
Database engine, table schema, partition keys (PK/SK), and durability strategy.
What resource hits saturation first under 10x traffic? (CPU, disk IOPS, connection pools, network).
Worker crashes, network partitions, split-brain, poison pill DLQ, retries, and idempotency.
What did you sacrifice in exchange and why? (e.g. eventual consistency vs latency, cost vs redundancy).