Purchase caps, cart limits, and action quotas enforced in the API — not the UI. Per account, per identity.

Inventory held in a cart is released after a short window (5–15 minutes). Prevents indefinite hold-and-abandon tactics.

Identify bot clients by behavioral signals: missing browser APIs, unrealistic mouse patterns, headless browser indicators.

Challenge-response verification at high-value steps: checkout, account creation, referral redemption. Not at every step — only where abuse is likely.

Flag flows completed faster than humanly possible. A checkout completed in 300ms has no legitimate human explanation.

Require phone or email verification before high-value flows. Each real person has a finite number of phone numbers; bot operators can’t scale infinitely.

Monitor inventory depletion rate, referral redemption velocity, and account creation spikes. Security logs don’t reveal API6 — business metrics do.