A guestbook is the most Web 1.0 feature there is, and the most abused. The design took longer than the build.
Four reviews
The design went through four security reviews between 2026-09-25 and 2026-09-28. Each one changed something: how entries are stored and escaped, what the rate limits are, how a flood is bounded, what the moderation flow looks like, and what an attacker gains by trying.
The outcome was a set of limits that make the worst case boring rather than preventing it:
- No captcha, no accounts. Signing a guestbook should take ten seconds.
- Newest 30 shown. Everything older is kept but not rendered, so the page never grows.
- 50 a day, site-wide. Not per visitor; across the whole site. On a quiet personal homepage that is generous, and it bounds what a flood can do to the moderation queue.
- 100 waiting, maximum. New entries go to a queue for approval. When 100 are waiting, the form closes until the owner clears some.
Six slices
The build was split into six slices, S1 to S6: storage and the entry form, rendering in each theme, rate limits, the moderation queue, the approval tool, and the public launch. Each slice shipped as its own reviewed merge.
The guestbook went public on 2026-09-29. The moderation email that tells the owner when entries are waiting came a week later, as its own set of slices.