Hundreds of fake signups overnight, all with random gmail addresses

A checkbox is just a field, bots tick it. You need a real CAPTCHA checked by Supabase, not by your frontend:

1. Make a free Cloudflare Turnstile site key (invisible for most humans).
2. Supabase → Authentication → Attack Protection → enable CAPTCHA, choose Turnstile, paste the secret key.
3. In the signup form, render the Turnstile widget and pass its token:

await supabase.auth.signUp({
  email, password,
  options: { captchaToken },
})

Now Supabase rejects any signup without a valid token, even when bots call the API directly.

The dotted gmail addresses are a known pattern: bots use your confirmation mail to spam or to warm up addresses. That's why your quota burned.

Cleanup: the fakes never confirmed, so you can delete users where email_confirmed_at is null and created in that window.