Seen 2026-09-08 on a site mounted without KAITO (the hand-off form renders directly): the anti-spam input _hp has a real box (getBoundingClientRect width>0) and the visible text 'Leave this empty' next to the Send button. A visitor reads it as an instruction and may type into it (I did: the message was silently dropped). Expected: the honeypot is invisible to people (off-screen or display:none via the coral's own injected CSS, plus autocomplete=off tabindex=-1 aria-hidden) and the label is not rendered. Check whether the coral's stylesheet injection is what failed on that host or whether the rule never existed; add a test that the honeypot has no layout box in the form render.
Seen 2026-09-08 on a site mounted without KAITO (the hand-off form renders directly): the anti-spam input
_hphas a real box (getBoundingClientRect width>0) and the visible text 'Leave this empty' next to the Send button. A visitor reads it as an instruction and may type into it (I did: the message was silently dropped). Expected: the honeypot is invisible to people (off-screen or display:none via the coral's own injected CSS, plus autocomplete=off tabindex=-1 aria-hidden) and the label is not rendered. Check whether the coral's stylesheet injection is what failed on that host or whether the rule never existed; add a test that the honeypot has no layout box in the form render.