stack-auth · mantrakp04 · Apr 12, 2026 · Mar 28, 2026 · Mar 28, 2026 · Apr 4, 2026
diff --git a/apps/backend/src/lib/risk-scores.tsx b/apps/backend/src/lib/risk-scores.tsx
@@ -30,14 +30,17 @@ export type SignUpRiskAssessment = {
 export type SignUpRiskRecentStatsRequest = {
   signedUpAt: Date,
   signUpIp: string | null,
+  signUpEmailNormalized: string | null,
   signUpEmailBase: string | null,
   recentWindowHours: number,
   sameIpLimit: number,
+  sameEmailLimit: number,
   similarEmailLimit: number,
 };
 
 export type SignUpRiskRecentStats = {
   sameIpCount: number,
+  sameEmailCount: number,
   similarEmailCount: number,
 };
 
@@ -64,7 +67,7 @@ async function loadRecentSignUpStats(
   const schema = await getPrismaSchemaForTenancy(tenancy);
   const windowStart = new Date(request.signedUpAt.getTime() - request.recentWindowHours * 60 * 60 * 1000);
 
-  const [sameIpRows, similarEmailRows] = await Promise.all([
+  const [sameIpRows, sameEmailRows, similarEmailRows] = await Promise.all([
     request.signUpIp == null || request.sameIpLimit === 0
       ? []
       : prisma.$replica().$queryRaw<{ matched: number }[]>`
@@ -77,6 +80,18 @@ async function loadRecentSignUpStats(
           LIMIT ${request.sameIpLimit}
         `,
 
+    request.signUpEmailNormalized == null || request.sameEmailLimit === 0
+      ? []
+      : prisma.$replica().$queryRaw<{ matched: number }[]>`
+          SELECT 1 AS "matched"
+          FROM ${sqlQuoteIdent(schema)}."ProjectUser"
+          WHERE "tenancyId" = ${tenancy.id}::UUID
+            AND "isAnonymous" = false
+            AND "signedUpAt" >= ${windowStart}
+            AND "signUpEmailNormalized" = ${request.signUpEmailNormalized}
+          LIMIT ${request.sameEmailLimit}
+        `,
+
     request.signUpEmailBase == null || request.similarEmailLimit === 0
       ? []
       : prisma.$replica().$queryRaw<{ matched: number }[]>`
@@ -92,6 +107,7 @@ async function loadRecentSignUpStats(
 
   return {
     sameIpCount: sameIpRows.length,
+    sameEmailCount: sameEmailRows.length,
     similarEmailCount: similarEmailRows.length,
   };
 }
@@ -144,7 +160,7 @@ import.meta.vitest?.test("loaded private sign-up risk engine can calculate score
       turnstileAssessment: { status: "ok" },
     }, {
       checkPrimaryEmailRisk: async () => ({ emailableScore: null }),
-      loadRecentSignUpStats: async () => ({ sameIpCount: 0, similarEmailCount: 0 }),
+      loadRecentSignUpStats: async () => ({ sameIpCount: 0, sameEmailCount: 0, similarEmailCount: 0 }),
     });
 
     expect(assessment).toMatchInlineSnapshot(`

diff --git a/apps/backend/src/private/implementation b/apps/backend/src/private/implementation
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml