Dev builds abuse-resistant referral system by rewarding listings, not signups

A developer building Adsyte, a free directory for indie projects, has shared the fraud-resistant referral system they recently shipped for the platform. Instead of awarding tokens when a referred user signs up, the system only pays out when the recruit publishes their first listing, making abuse significantly harder. Additional safeguards include duplicate-URL detection, hCaptcha verification, a Redis-based mechanism to prevent double payouts, and a daily reward cap per referrer. Referral codes are generated as HMACs of user IDs rather than stored as random tokens, reducing the risk of leaks or unnecessary data overhead. The developer describes the core principle as 'pay for the outcome, not the action,' arguing this approach eliminates the need for bolt-on fraud detection altogether.