Formcarry

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me a form endpoint that replaces Formcarry: my static site posts to it, the submission arrives, and the spam does not.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- No client-side framework — this must work from a plain HTML form with no JavaScript at all
- Caddy in front

THE DATA MODEL
- forms: id, uid, name, target_emails_json, redirect_url, allowed_origins_json, is_active, created_at
- submissions: id, form_id, payload_json, spam_score, spam_reasons_json, status, ip_hash, referrer, user_agent_bucket, country, created_at
- files: id, submission_id, field, path, sha256, mime_detected, bytes, scan_status
- deliveries: id, submission_id, target_kind, target, status, attempts, response_excerpt, at
- blocklist: id, kind, value, reason, added_at
- Every submission stored, including the ones judged spam. A false positive that was silently dropped is a customer you never knew wrote to you

THE ENDPOINT
- POST to /f/:uid as form-encoded or multipart, exactly as a browser sends it
- Answers with a redirect to the form's thank-you page, or JSON if the request asked for it. Both paths must work
- Origin checked against the form's allow-list; a submission from elsewhere is refused and recorded
- Reserved fields for the redirect, the subject and the reply-to address, all validated

SPAM, WHICH IS THE ENTIRE PRODUCT AFTER WEEK ONE
- A honeypot field, documented, that a real form includes hidden and a bot fills in
- A minimum time between the page rendering and the form arriving, carried in a signed token. Bots post instantly
- Rate limits per address hash, per form and globally
- Content signals scored rather than judged: link count, all-capitals, a body that is a URL, a missing referrer, a user agent that is a library
- A score with reasons attached and a threshold per form. Above it the submission is held for review, never discarded
- Optional third-party checking, off by default, with the README saying plainly that turning it on sends the submission text to somebody else

FILES
- Multipart streamed to disk with a hard byte limit enforced as it arrives, never buffered whole
- Type from the file's own content, not the filename; an allow-list per form, not a block-list
- EXIF stripped from images, including the location a phone photograph carries
- Stored by hash outside the web root and served through a signed expiring link in the notification email — never attached, because attachments are what get the notification marked as spam

DELIVERY
- Email with the fields laid out readably and the reply-to set to the submitter, so replying works — which is what people actually want
- Webhook with an HMAC signature, retried with backoff, idempotent by submission id
- A daily digest option instead of one email per submission
- Send from your own domain with SPF, DKIM and DMARC configured; the From address is yours and the submitter's is only ever the reply-to

OPERATIONS
- .env: DATABASE_PATH, STORAGE_PATH, BASE_URL, SMTP_URL, FROM_ADDRESS, SESSION_SECRET, HASH_SALT, SIGNING_SECRET
- Migrations on boot, each once; nightly backup off the machine, restore script
- Health endpoint that checks the mail connection

WHAT MATTERS MOST
Spam scoring with reasons, and never dropping anything. Build the honeypot, the timing token and the review queue first, then leave a form public for a fortnight and read what arrives.