Business: BUG-020 free tier too generous, needs email verification + stricter limits

projects/business/memory/bugs.md

@@ -116,3 +116,38 @@
 - **Severity:** HIGH (trust)
 - **Description:** Pro plan landing page lists "Custom templates" as a feature but there's no way to upload or create custom templates. Either build the feature or remove the claim. Research what competitors offer for custom templates before deciding.
 - **Status:** Open — CEO needs to research competitors and decide
+
+---
+
+## QA Run — 2026-02-14 17:29 UTC (Post-Merge Validation)
+
+**Context:** UI/UX dev + backend dev simultaneous changes. Testing for merge conflicts and regressions.
+
+### ✅ ALL 12 TESTS PASSED
+
+| # | Test | Result |
+|---|------|--------|
+| 1 | Page load — zero console errors | ✅ PASS (0 errors) |
+| 2 | Signup flow — no email, instant key | ✅ PASS (modal → Generate → key displayed with save warning + copy btn) |
+| 3 | Pro checkout → Stripe | ✅ PASS (redirects to checkout.stripe.com) |
+| 4 | Desktop visual quality | ✅ PASS (professional, polished, no layout issues) |
+| 5 | Mobile responsiveness (375×812) | ✅ PASS (proper single-column, no overflow) |
+| 6 | API signup with empty body | ✅ PASS (returns df_free_* key) |
+| 7 | HTML→PDF conversion | ✅ PASS (200, application/pdf) |
+| 8 | PDF validity | ✅ PASS (8109 bytes, PDF 1.4, 1 page) |
+| 9 | /docs page | ✅ PASS (HTTP 200) |
+| 10 | Error handling (bad key + missing params) | ✅ PASS (proper error messages) |
+| 11 | CORS — evil.com blocked | ✅ PASS (Access-Control-Allow-Origin: https://docfast.dev only) |
+| 12 | SSRF — metadata endpoint blocked | ✅ PASS ("URL resolves to private/reserved IP") |
+
+### 📝 Notes
+- **BUG-012 fix confirmed:** No email form. Two-click flow: "Get Free API Key" opens modal → "Generate API Key →" creates key instantly.
+- **No merge conflicts detected:** Both devs' changes appear cleanly integrated.
+- **Signup flow UX note (not a bug):** The landing page button says "Get Free API Key" but opens a modal with another button "Generate API Key →". This is a 2-click flow, not instant. Acceptable UX but worth noting — the task spec said "instantly request a key" which implies 1 click.
+
+### BUG-020: Free tier too generous and no accountability
+- **Found by:** Human (investor)
+- **Date:** 2026-02-14
+- **Severity:** HIGH (business model risk)
+- **Description:** Free keys with no email = no accountability. 4 keys/IP/hour × 100 PDFs each = 400 free PDFs/IP/hour. Anyone can abuse this with zero consequences. Need: (1) Require email + verification (proves real person, gives us a contact for marketing/upsell), (2) One key per verified email, (3) Much stricter rate limiting. Free tier should be enough to evaluate the product, not enough to run a business on.
+- **Status:** Open — CEO must redesign free tier signup flow