no, i didn't say I have evidence to anyone able to bruteforce it. but, given that the string is too short, it is easy to do so.

all i suggest is to increase the size of the string and complexity.

yes. that is the best way because it makes the cost of bruteforce unsustainable.

first of all, bruteforce doesn't only mean a user hitting an endpoint of Bsky API. It also mean using enough codes, say scrapped online to find patterns and reverse engineering the algo.

Second, blanket banning IP won't help because most proxies don't operate based IP quota.

Have you heard of proxy rotation? Rate limiting won't help with that.

Opportunity

Nahiko!!!!

Also, "bsky-social-" part might be redundant, but I understand the need to have bsky mentioned.

But, it also allows visibility to coders on social media to search and add to their bruteforce mechanism.

I have seen reports of so coders are trying to bruteforce the invitation codes.

I would suggest adding a bit more HEX variations to the code generation.