Codes that leak
and get reused

Catch code guessing, repeat redemptions and offers spreading across coupon sites.

Decision trace

Before and after redemption

1. Gate the offer

   Your backend sends the code with result attempt. Check the decision before applying a discount.

2. Report the outcome

   Record redeemed, invalid or rejected. Five invalid codes per device or twenty per IP prefix block further attempts for an hour.

3. Review linked use

   Two campaign codes on one device or linked-account cluster trigger a limit. One code used across linked accounts also triggers a limit.

The dashboard shows leaked code hash prefixes, campaigns and counts, plus top enumerating sources. Adjust thresholds or clear history from site settings. Raw codes are never stored.

Templated email addresses

Templated email addresses reveal another kind of repeat signup. Five similar locals on one domain in 24 hours can add email_pattern_burst, using a narrow numeric range or shared four-letter prefix. Freemail needs the prefix match: john.smith1984 and jane.doe1990 on Gmail are not grouped by their years alone.

Random-looking locals are telemetry only. They carry no score or repeat-limit weight.

API

const result = await nolgard.promo({
  code: request.body.code,
  accountId: user.id,
  ip: clientIp,
  campaign: 'fall',
  result: 'attempt'
});
// Apply your offer only when the decision permits it.
// Afterward report redeemed, invalid, or rejected.

Run this server-side. A browser token minted for action redeem adds device identity. Leak detection sees how redemptions spread; it never reads coupon websites.

Limits

• Defaults are logical starting points and carry no measured guarantee. Tune them for your offer.
• Families sharing a device or code may look like multi-account abuse. Reusable public codes can look leaked.
• Corporate NAT and carrier networks share IP prefixes. Network counts do not prove one person.
• Missing identifiers, fresh devices and varied email prefixes reduce coverage.
• Attempt checks are not atomic reservations. Your backend still owns coupon uniqueness and discount application.
• Leak markers remain until cleared. Redemption history covers 30 days; email patterns cover 24 hours.

Related

• Repeat accounts
• Email intelligence