cost 100 → 50000: was solvable in milliseconds by a bot, now takes
~1-2s in a real browser, making mass automation impractical.
expiresAt 10min: embeds expiry in the HMAC-signed challenge so the
server rejects replayed tokens without needing to store seen challenges.
ALTCHA_HMAC_KEY must be set to a strong secret in production.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
chris
08ac545567