From 3501e5937db29853ec663723fecbd248e360ee47 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 10:39:32 +0100
Subject: [PATCH 01/18] feat: add Cloudflare Turnstile siteverify helper

Canonical fail-closed verification against challenges.cloudflare.com
using TURNSTILE_SECRET and the request token/IP.
---
 utils/turnstile.test.js | 90 +++++++++++++++++++++++++++++++++++++++++
 utils/turnstile.ts      | 79 ++++++++++++++++++++++++++++++++++++
 2 files changed, 169 insertions(+)
 create mode 100644 utils/turnstile.test.js
 create mode 100644 utils/turnstile.ts

diff --git a/utils/turnstile.test.js b/utils/turnstile.test.js
new file mode 100644
index 000000000..2fc1b5bbc
--- /dev/null
+++ b/utils/turnstile.test.js
@@ -0,0 +1,90 @@
+/** @jest-environment node */
+/* eslint-env jest, node */
+
+const {
+  getClientIp,
+  getTurnstileToken,
+  verifyTurnstileToken,
+  TURNSTILE_TOKEN_FIELD,
+} = require('./turnstile.ts')
+
+describe('turnstile helpers', () => {
+  const originalSecret = process.env.TURNSTILE_SECRET
+
+  beforeEach(() => {
+    process.env.TURNSTILE_SECRET = 'test-secret'
+  })
+
+  afterAll(() => {
+    if (originalSecret === undefined) {
+      delete process.env.TURNSTILE_SECRET
+    } else {
+      process.env.TURNSTILE_SECRET = originalSecret
+    }
+  })
+
+  it('reads the token field from the request body', () => {
+    expect(
+      getTurnstileToken({ [TURNSTILE_TOKEN_FIELD]: 'token-abc' })
+    ).toBe('token-abc')
+    expect(getTurnstileToken({ [TURNSTILE_TOKEN_FIELD]: '' })).toBeUndefined()
+    expect(getTurnstileToken({})).toBeUndefined()
+  })
+
+  it('prefers the first x-forwarded-for hop', () => {
+    expect(
+      getClientIp({
+        headers: { 'x-forwarded-for': '1.2.3.4, 5.6.7.8' },
+        socket: { remoteAddress: '127.0.0.1' },
+      })
+    ).toBe('1.2.3.4')
+  })
+
+  it('siteverifies successfully when Cloudflare returns success', async () => {
+    const fetchImpl = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ success: true }),
+    })
+
+    await expect(
+      verifyTurnstileToken('token', '1.2.3.4', fetchImpl)
+    ).resolves.toBe(true)
+
+    expect(fetchImpl).toHaveBeenCalledWith(
+      'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+      expect.objectContaining({
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      })
+    )
+    const body = fetchImpl.mock.calls[0][1].body
+    expect(body.get('secret')).toBe('test-secret')
+    expect(body.get('response')).toBe('token')
+    expect(body.get('remoteip')).toBe('1.2.3.4')
+  })
+
+  it('fails closed when Cloudflare returns success false', async () => {
+    const fetchImpl = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        success: false,
+        'error-codes': ['invalid-input-response'],
+      }),
+    })
+
+    await expect(verifyTurnstileToken('token', undefined, fetchImpl)).resolves.toBe(
+      false
+    )
+  })
+
+  it('fails closed on network errors and missing secret or token', async () => {
+    await expect(
+      verifyTurnstileToken('token', undefined, jest.fn().mockRejectedValue(new Error('net')))
+    ).resolves.toBe(false)
+
+    await expect(verifyTurnstileToken(undefined)).resolves.toBe(false)
+
+    delete process.env.TURNSTILE_SECRET
+    await expect(verifyTurnstileToken('token')).resolves.toBe(false)
+  })
+})
diff --git a/utils/turnstile.ts b/utils/turnstile.ts
new file mode 100644
index 000000000..2fa778a67
--- /dev/null
+++ b/utils/turnstile.ts
@@ -0,0 +1,79 @@
+import type { NextApiRequest } from 'next'
+
+export const TURNSTILE_TOKEN_FIELD = 'cf-turnstile-response'
+
+export const TURNSTILE_FAILURE_MESSAGE =
+  'Bot verification failed. Please try again.'
+
+interface SiteverifyResult {
+  success?: boolean
+  'error-codes'?: string[]
+}
+
+export function getClientIp(req: NextApiRequest): string | undefined {
+  const forwarded = req.headers['x-forwarded-for']
+  if (typeof forwarded === 'string' && forwarded.length > 0) {
+    return forwarded.split(',')[0]?.trim() || undefined
+  }
+  if (Array.isArray(forwarded) && forwarded[0]) {
+    return forwarded[0].split(',')[0]?.trim() || undefined
+  }
+  const realIp = req.headers['x-real-ip']
+  if (typeof realIp === 'string' && realIp.length > 0) {
+    return realIp
+  }
+  return req.socket?.remoteAddress || undefined
+}
+
+export function getTurnstileToken(body: unknown): string | undefined {
+  if (!body || typeof body !== 'object') return undefined
+  const token = (body as Record<string, unknown>)[TURNSTILE_TOKEN_FIELD]
+  return typeof token === 'string' && token.length > 0 ? token : undefined
+}
+
+/**
+ * Canonical Cloudflare Turnstile siteverify.
+ * Fail closed on network errors, non-2xx, bad JSON, or success !== true.
+ */
+export async function verifyTurnstileToken(
+  token: string | undefined,
+  remoteip?: string,
+  fetchImpl: typeof fetch = fetch
+): Promise<boolean> {
+  const secret = process.env.TURNSTILE_SECRET
+  if (!secret || !token) return false
+
+  try {
+    const params = new URLSearchParams({
+      secret,
+      response: token,
+    })
+    if (remoteip) params.set('remoteip', remoteip)
+
+    const response = await fetchImpl(
+      'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: params,
+      }
+    )
+    if (!response.ok) return false
+
+    const result = (await response.json()) as SiteverifyResult
+    return result.success === true
+  } catch {
+    return false
+  }
+}
+
+export async function assertTurnstile(
+  req: NextApiRequest,
+  fetchImpl: typeof fetch = fetch
+): Promise<boolean> {
+  return verifyTurnstileToken(
+    getTurnstileToken(req.body),
+    getClientIp(req),
+    fetchImpl
+  )
+}

From 82ff442eaa5f1bff08b10405da068c3e7efa78b8 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 10:39:40 +0100
Subject: [PATCH 02/18] feat: require Turnstile verification on grant apply
 APIs

Gate `/api/github` and `/api/sendgrid` on canonical siteverify before
creating issues or sending mail. Strip the token from the email body.
---
 pages/api/github.ts   |  8 ++++++++
 pages/api/sendgrid.ts | 10 ++++++++++
 2 files changed, 18 insertions(+)

diff --git a/pages/api/github.ts b/pages/api/github.ts
index 481124b16..1102229f0 100644
--- a/pages/api/github.ts
+++ b/pages/api/github.ts
@@ -1,4 +1,8 @@
 import { NextApiRequest, NextApiResponse } from 'next/types'
+import {
+  assertTurnstile,
+  TURNSTILE_FAILURE_MESSAGE,
+} from '@/utils/turnstile'
 
 const GH_ACCESS_TOKEN = process.env.GH_ACCESS_TOKEN
 const GH_ORG = process.env.GH_ORG
@@ -12,6 +16,10 @@ export default async function handler(
   res: NextApiResponse
 ) {
   if (req.method === 'POST') {
+    if (!(await assertTurnstile(req))) {
+      return res.status(403).json({ message: TURNSTILE_FAILURE_MESSAGE })
+    }
+
     if (!GH_ACCESS_TOKEN || !GH_ORG || !GH_APP_REPO) {
       throw new Error('Env misconfigured')
     }
diff --git a/pages/api/sendgrid.ts b/pages/api/sendgrid.ts
index fb38bc990..f99b74b86 100644
--- a/pages/api/sendgrid.ts
+++ b/pages/api/sendgrid.ts
@@ -1,6 +1,11 @@
 import { NextApiRequest, NextApiResponse } from 'next/types'
 import sgMail from '@sendgrid/mail'
 import { marked } from 'marked'
+import {
+  assertTurnstile,
+  TURNSTILE_FAILURE_MESSAGE,
+  TURNSTILE_TOKEN_FIELD,
+} from '@/utils/turnstile'
 
 const SENDGRID_API_KEY = process.env.SENDGRID_API_KEY
 const TO_ADDRESS = process.env.SENDGRID_RECIPIENT
@@ -263,11 +268,16 @@ export default async function handler(
     return res.status(405).end('Method Not Allowed')
   }
 
+  if (!(await assertTurnstile(req))) {
+    return res.status(403).json({ message: TURNSTILE_FAILURE_MESSAGE })
+  }
+
   if (!SENDGRID_API_KEY || !TO_ADDRESS || !FROM_ADDRESS) {
     throw new Error('Env misconfigured')
   }
 
   const body = Object.entries(req.body)
+    .filter(([key]) => key !== TURNSTILE_TOKEN_FIELD)
     .map(
       ([key, value]) => `<h3>${escapeHtml(key)}</h3><p>${escapeHtml(value)}</p>`
     )

From 2fcd911bb084de98090aae1b935c3d9421db62ba Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 10:40:35 +0100
Subject: [PATCH 03/18] feat: embed Turnstile on grant application submit

Show the challenge on the final step, require a token before submit,
and refresh the token between GitHub and SendGrid siteverify calls.
---
 .../MultiStepApplicationForm.tsx              |  23 ++-
 .../grant-application/TurnstileWidget.tsx     | 137 ++++++++++++++++++
 utils/application-submission.test.js          |  63 +++++---
 utils/application-submission.ts               |  47 +++++-
 4 files changed, 246 insertions(+), 24 deletions(-)
 create mode 100644 components/grant-application/TurnstileWidget.tsx

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index fdd5466e8..6765262d4 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -9,6 +9,7 @@ import {
 } from '../../utils/application-submission'
 import StepIndicator from './StepIndicator'
 import StepNavigation from './StepNavigation'
+import TurnstileWidget, { TurnstileWidgetHandle } from './TurnstileWidget'
 import { FormValues, StepProps } from './types'
 
 export interface StepConfig {
@@ -38,7 +39,9 @@ export default function MultiStepApplicationForm({
   const [loading, setLoading] = useState(false)
   const [failureReason, setFailureReason] = useState<string>()
   const [failedAttempts, setFailedAttempts] = useState(0)
+  const [turnstileReady, setTurnstileReady] = useState(false)
   const formRef = useRef<HTMLFormElement>(null)
+  const turnstileRef = useRef<TurnstileWidgetHandle>(null)
   const router = useRouter()
 
   const {
@@ -84,7 +87,10 @@ export default function MultiStepApplicationForm({
     }
   }
 
-  const submitDisabled = !!submitRequiresChecked?.some((name) => !watch(name))
+  const isLastStep = currentStep === steps.length - 1
+  const submitDisabled =
+    !!submitRequiresChecked?.some((name) => !watch(name)) ||
+    (isLastStep && !turnstileReady)
 
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const onSubmit = async (data: any) => {
@@ -94,7 +100,11 @@ export default function MultiStepApplicationForm({
     setFailureReason(undefined)
 
     try {
-      await submitApplication(data)
+      const turnstile = turnstileRef.current
+      if (!turnstile) {
+        throw new Error('Please complete the bot verification challenge.')
+      }
+      await submitApplication(data, undefined, turnstile)
       await router.push('/submitted')
     } catch (e) {
       const nextFailures = failedAttempts + 1
@@ -105,6 +115,8 @@ export default function MultiStepApplicationForm({
           ? `${baseMessage} ${SUBMISSION_CONTACT}`
           : baseMessage
       )
+      setTurnstileReady(false)
+      void turnstileRef.current?.reset()
     } finally {
       setLoading(false)
     }
@@ -132,6 +144,13 @@ export default function MultiStepApplicationForm({
 
       {steps[currentStep].render(stepProps)}
 
+      {isLastStep && (
+        <TurnstileWidget
+          ref={turnstileRef}
+          onTokenChange={(token) => setTurnstileReady(!!token)}
+        />
+      )}
+
       <StepNavigation
         currentStep={currentStep}
         totalSteps={steps.length}
diff --git a/components/grant-application/TurnstileWidget.tsx b/components/grant-application/TurnstileWidget.tsx
new file mode 100644
index 000000000..55184cf93
--- /dev/null
+++ b/components/grant-application/TurnstileWidget.tsx
@@ -0,0 +1,137 @@
+import Script from 'next/script'
+import {
+  forwardRef,
+  useCallback,
+  useEffect,
+  useImperativeHandle,
+  useRef,
+  useState,
+} from 'react'
+
+const TURNSTILE_SCRIPT = 'https://challenges.cloudflare.com/turnstile/v0/api.js'
+const SITE_KEY = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY
+
+declare global {
+  interface Window {
+    turnstile?: {
+      render: (
+        element: HTMLElement,
+        options: {
+          sitekey: string
+          action?: string
+          callback?: (token: string) => void
+          'expired-callback'?: () => void
+          'error-callback'?: () => void
+        }
+      ) => string
+      reset: (widgetId?: string) => void
+      remove: (widgetId?: string) => void
+    }
+  }
+}
+
+export interface TurnstileWidgetHandle {
+  getToken: () => string | undefined
+  waitForToken: () => Promise<string>
+  reset: () => Promise<string>
+}
+
+interface TurnstileWidgetProps {
+  onTokenChange?: (token: string | undefined) => void
+}
+
+const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
+  function TurnstileWidget({ onTokenChange }, ref) {
+    const containerRef = useRef<HTMLDivElement>(null)
+    const widgetIdRef = useRef<string>()
+    const tokenRef = useRef<string>()
+    const waitersRef = useRef<Array<(token: string) => void>>([])
+    const [scriptReady, setScriptReady] = useState(false)
+
+    const setToken = useCallback(
+      (token: string | undefined) => {
+        tokenRef.current = token
+        onTokenChange?.(token)
+        if (token) {
+          const waiters = waitersRef.current
+          waitersRef.current = []
+          waiters.forEach((resolve) => resolve(token))
+        }
+      },
+      [onTokenChange]
+    )
+
+    const waitForToken = useCallback(() => {
+      if (tokenRef.current) return Promise.resolve(tokenRef.current)
+      return new Promise<string>((resolve) => {
+        waitersRef.current.push(resolve)
+      })
+    }, [])
+
+    const reset = useCallback(() => {
+      setToken(undefined)
+      if (widgetIdRef.current && window.turnstile) {
+        window.turnstile.reset(widgetIdRef.current)
+      }
+      return waitForToken()
+    }, [setToken, waitForToken])
+
+    useImperativeHandle(
+      ref,
+      () => ({
+        getToken: () => tokenRef.current,
+        waitForToken,
+        reset,
+      }),
+      [reset, waitForToken]
+    )
+
+    useEffect(() => {
+      if (!scriptReady || !SITE_KEY || !containerRef.current || !window.turnstile) {
+        return
+      }
+      if (widgetIdRef.current) return
+
+      widgetIdRef.current = window.turnstile.render(containerRef.current, {
+        sitekey: SITE_KEY,
+        action: 'turnstile-spin-v2',
+        callback: (token) => setToken(token),
+        'expired-callback': () => setToken(undefined),
+        'error-callback': () => setToken(undefined),
+      })
+
+      return () => {
+        if (widgetIdRef.current && window.turnstile) {
+          window.turnstile.remove(widgetIdRef.current)
+          widgetIdRef.current = undefined
+        }
+      }
+    }, [scriptReady, setToken])
+
+    if (!SITE_KEY) {
+      return (
+        <p className="text-sm text-red-600">
+          Turnstile is not configured (`NEXT_PUBLIC_TURNSTILE_SITE_KEY`).
+        </p>
+      )
+    }
+
+    return (
+      <>
+        <Script
+          src={`${TURNSTILE_SCRIPT}?render=explicit`}
+          strategy="afterInteractive"
+          onLoad={() => setScriptReady(true)}
+        />
+        <div
+          ref={containerRef}
+          className="cf-turnstile"
+          data-sitekey={SITE_KEY}
+          data-action="turnstile-spin-v2"
+        />
+      </>
+    )
+  }
+)
+
+export default TurnstileWidget
diff --git a/utils/application-submission.test.js b/utils/application-submission.test.js
index 4acb29e47..f69c21b7b 100644
--- a/utils/application-submission.test.js
+++ b/utils/application-submission.test.js
@@ -6,10 +6,24 @@ const { submitApplication } = require('./application-submission.ts')
 describe('submitApplication', () => {
   const submission = { project_name: 'Test project' }
 
-  it('creates the GitHub record before sending email', async () => {
+  function turnstileMock(tokens) {
+    let index = 0
+    return {
+      waitForToken: jest.fn(async () => tokens[Math.min(index, tokens.length - 1)]),
+      reset: jest.fn(async () => {
+        index += 1
+        return tokens[Math.min(index, tokens.length - 1)]
+      }),
+    }
+  }
+
+  it('creates the GitHub record before sending email, with fresh tokens', async () => {
     const postJSON = jest.fn().mockResolvedValue({ message: 'success' })
+    const turnstile = turnstileMock(['token-1', 'token-2'])
 
-    await expect(submitApplication(submission, postJSON)).resolves.toEqual({
+    await expect(
+      submitApplication(submission, postJSON, turnstile)
+    ).resolves.toEqual({
       github: true,
       email: true,
     })
@@ -17,14 +31,20 @@ describe('submitApplication', () => {
       '/api/github',
       '/api/sendgrid',
     ])
+    expect(postJSON.mock.calls[0][1]['cf-turnstile-response']).toBe('token-1')
+    expect(postJSON.mock.calls[1][1]['cf-turnstile-response']).toBe('token-2')
+    expect(turnstile.reset).toHaveBeenCalledTimes(1)
   })
 
   it('succeeds when GitHub is confirmed even if email fails', async () => {
     const postJSON = jest.fn(async (url) => ({
       message: url === '/api/github' ? 'success' : 'Email delivery failed',
     }))
+    const turnstile = turnstileMock(['token-1', 'token-2'])
 
-    await expect(submitApplication(submission, postJSON)).resolves.toEqual({
+    await expect(
+      submitApplication(submission, postJSON, turnstile)
+    ).resolves.toEqual({
       github: true,
       email: false,
     })
@@ -35,12 +55,17 @@ describe('submitApplication', () => {
       if (url === '/api/github') throw new Error('GitHub unavailable')
       return { message: 'success' }
     })
+    const turnstile = turnstileMock(['token-1', 'token-2'])
 
-    await expect(submitApplication(submission, postJSON)).rejects.toThrow(
-      'Please try again.'
-    )
+    await expect(
+      submitApplication(submission, postJSON, turnstile)
+    ).rejects.toThrow('Please try again.')
     expect(postJSON).toHaveBeenCalledTimes(1)
-    expect(postJSON).toHaveBeenCalledWith('/api/github', submission)
+    expect(postJSON).toHaveBeenCalledWith(
+      '/api/github',
+      expect.objectContaining({ 'cf-turnstile-response': 'token-1' })
+    )
+    expect(turnstile.reset).toHaveBeenCalled()
   })
 
   it('forces a retry when GitHub returns a non-success response', async () => {
@@ -48,20 +73,24 @@ describe('submitApplication', () => {
       message:
         url === '/api/github' ? 'Application storage failed' : 'success',
     }))
+    const turnstile = turnstileMock(['token-1', 'token-2'])
 
-    await expect(submitApplication(submission, postJSON)).rejects.toThrow(
-      'It has not been marked as submitted'
-    )
+    await expect(
+      submitApplication(submission, postJSON, turnstile)
+    ).rejects.toThrow('It has not been marked as submitted')
     expect(postJSON).toHaveBeenCalledTimes(1)
   })
 
-  it('does not mention applications@ in the base error', async () => {
-    const postJSON = jest.fn().mockRejectedValue(new Error('Network error'))
+  it('requires a turnstile token before submitting', async () => {
+    const postJSON = jest.fn()
+    const turnstile = {
+      waitForToken: jest.fn(async () => ''),
+      reset: jest.fn(),
+    }
 
-    await expect(submitApplication(submission, postJSON)).rejects.toThrow(
-      "We couldn't create your application record on GitHub. It has not been marked as submitted. Please try again."
-    )
+    await expect(
+      submitApplication(submission, postJSON, turnstile)
+    ).rejects.toThrow('bot verification')
+    expect(postJSON).not.toHaveBeenCalled()
   })
 })
-
-
diff --git a/utils/application-submission.ts b/utils/application-submission.ts
index 513ea120b..ef37da555 100644
--- a/utils/application-submission.ts
+++ b/utils/application-submission.ts
@@ -1,4 +1,5 @@
 import { fetchPostJSON } from './api-helpers'
+import { TURNSTILE_TOKEN_FIELD } from './turnstile'
 
 export interface ApplicationSubmissionData {
   [key: string]: unknown
@@ -13,6 +14,11 @@ type PostJSON = (
   data: ApplicationSubmissionData
 ) => Promise<DestinationResponse>
 
+export interface TurnstileControls {
+  waitForToken: () => Promise<string>
+  reset: () => Promise<string>
+}
+
 export interface ApplicationDeliveryResult {
   github: boolean
   email: boolean
@@ -40,17 +46,48 @@ async function postSucceeded(
   }
 }
 
+function withTurnstileToken(
+  data: ApplicationSubmissionData,
+  token: string
+): ApplicationSubmissionData {
+  return { ...data, [TURNSTILE_TOKEN_FIELD]: token }
+}
+
 export async function submitApplication(
   data: ApplicationSubmissionData,
-  postJSON: PostJSON = fetchPostJSON
+  postJSON: PostJSON = fetchPostJSON,
+  turnstile?: TurnstileControls
 ): Promise<ApplicationDeliveryResult> {
-  // GitHub first: only email after the issue exists, so retries do not
-  // re-send the applicant receipt or internal copy on a failed create.
-  const github = await postSucceeded(postJSON, '/api/github', data)
+  // Tokens are single-use: verify one for GitHub, then reset and verify
+  // another for SendGrid so siteverify does not reject timeout-or-duplicate.
+  const githubToken = turnstile
+    ? await turnstile.waitForToken()
+    : String(data[TURNSTILE_TOKEN_FIELD] || '')
+
+  if (!githubToken) {
+    throw new Error('Please complete the bot verification challenge.')
+  }
+
+  const github = await postSucceeded(
+    postJSON,
+    '/api/github',
+    withTurnstileToken(data, githubToken)
+  )
   if (!github) {
+    if (turnstile) {
+      void turnstile.reset()
+    }
     throw new Error(SUBMISSION_ERROR)
   }
 
-  const email = await postSucceeded(postJSON, '/api/sendgrid', data)
+  const emailToken = turnstile
+    ? await turnstile.reset()
+    : String(data[TURNSTILE_TOKEN_FIELD] || '')
+
+  const email = await postSucceeded(
+    postJSON,
+    '/api/sendgrid',
+    withTurnstileToken(data, emailToken)
+  )
   return { github, email }
 }

From d863dde7f243de740cc776208658a9d50ac236fb Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 10:40:35 +0100
Subject: [PATCH 04/18] test: cover Turnstile gating on grant apply APIs

Document NEXT_PUBLIC_TURNSTILE_SITE_KEY and TURNSTILE_SECRET, and reject
unverified requests in the SendGrid and GitHub API suites.
---
 .env.example               |  4 ++
 tests/api/github.test.js   | 97 ++++++++++++++++++++++++++++++++++++++
 tests/api/sendgrid.test.js | 28 +++++++++++
 3 files changed, 129 insertions(+)
 create mode 100644 tests/api/github.test.js

diff --git a/.env.example b/.env.example
index 5af8b23bf..7e83377b1 100644
--- a/.env.example
+++ b/.env.example
@@ -16,6 +16,10 @@ ZAPRITE_USER_UUID=
 NEXT_PUBLIC_GOOGLE_DOC_ID=
 NEXT_PUBLIC_GOOGLE_API_KEY=
 
+# Cloudflare Turnstile (grant application forms)
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=0x4AAAAAAEKByBDYEcxiPW-n
+TURNSTILE_SECRET=
+
 # Fund-specific webhook secrets
 BTCPAY_WEBHOOK_SECRET_GENERAL=generated_by_btcpay
 BTCPAY_WEBHOOK_SECRET_NOSTR=generated_by_btcpay
diff --git a/tests/api/github.test.js b/tests/api/github.test.js
new file mode 100644
index 000000000..c465f14da
--- /dev/null
+++ b/tests/api/github.test.js
@@ -0,0 +1,97 @@
+/** @jest-environment node */
+/* eslint-env jest, node */
+
+process.env.GH_ACCESS_TOKEN = 'test-token'
+process.env.GH_ORG = 'OpenSats'
+process.env.GH_APP_REPO = 'applications'
+process.env.TURNSTILE_SECRET = 'test-turnstile-secret'
+
+jest.mock('@octokit/rest', () => {
+  const create = jest.fn()
+  return {
+    Octokit: jest.fn().mockImplementation(() => ({
+      rest: { issues: { create } },
+    })),
+    __create: create,
+  }
+})
+
+jest.mock('@/utils/turnstile', () => {
+  const actual = jest.requireActual('@/utils/turnstile')
+  return {
+    ...actual,
+    assertTurnstile: jest.fn(),
+  }
+})
+
+const { __create: createIssue } = require('@octokit/rest')
+const { assertTurnstile } = require('@/utils/turnstile')
+const handler = require('../../pages/api/github.ts').default
+
+function responseMock() {
+  return {
+    statusCode: undefined,
+    payload: undefined,
+    headers: {},
+    status(code) {
+      this.statusCode = code
+      return this
+    },
+    json(payload) {
+      this.payload = payload
+      return this
+    },
+    setHeader(name, value) {
+      this.headers[name] = value
+    },
+    end(payload) {
+      this.payload = payload
+      return this
+    },
+  }
+}
+
+const validApplication = {
+  project_name: 'Test project',
+  your_name: 'Applicant',
+  short_description: 'Description',
+  potential_impact: 'Impact',
+  proposed_budget: '1 BTC',
+  main_focus: 'nostr',
+  'cf-turnstile-response': 'test-token',
+}
+
+describe('/api/github', () => {
+  beforeEach(() => {
+    createIssue.mockReset()
+    createIssue.mockResolvedValue({ data: { number: 1 } })
+    assertTurnstile.mockReset()
+    assertTurnstile.mockResolvedValue(true)
+    jest.spyOn(console, 'log').mockImplementation(() => undefined)
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('creates an issue when Turnstile verification succeeds', async () => {
+    const response = responseMock()
+
+    await handler({ method: 'POST', body: validApplication }, response)
+
+    expect(response.statusCode).toBe(200)
+    expect(response.payload).toEqual({ message: 'success' })
+    expect(createIssue).toHaveBeenCalled()
+  })
+
+  it('rejects requests that fail Turnstile verification', async () => {
+    assertTurnstile.mockResolvedValue(false)
+    const response = responseMock()
+
+    await handler({ method: 'POST', body: validApplication }, response)
+
+    expect(response.statusCode).toBe(403)
+    expect(response.payload.message).not.toBe('success')
+    expect(createIssue).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/api/sendgrid.test.js b/tests/api/sendgrid.test.js
index f0da3e334..acb4013dc 100644
--- a/tests/api/sendgrid.test.js
+++ b/tests/api/sendgrid.test.js
@@ -5,6 +5,7 @@ process.env.SENDGRID_API_KEY = 'test-key'
 process.env.SENDGRID_RECIPIENT = 'applications@opensats.test'
 process.env.SENDGRID_CC = 'backup@opensats.test'
 process.env.SENDGRID_VERIFIED_SENDER = 'sender@opensats.test'
+process.env.TURNSTILE_SECRET = 'test-turnstile-secret'
 
 jest.mock('@sendgrid/mail', () => ({
   __esModule: true,
@@ -14,7 +15,16 @@ jest.mock('@sendgrid/mail', () => ({
   },
 }))
 
+jest.mock('@/utils/turnstile', () => {
+  const actual = jest.requireActual('@/utils/turnstile')
+  return {
+    ...actual,
+    assertTurnstile: jest.fn(),
+  }
+})
+
 const sgMail = require('@sendgrid/mail').default
+const { assertTurnstile } = require('@/utils/turnstile')
 const handler = require('../../pages/api/sendgrid.ts').default
 
 function responseMock() {
@@ -44,11 +54,14 @@ const validApplication = {
   project_name: 'Test project',
   email: 'applicant@example.org',
   short_description: 'Description',
+  'cf-turnstile-response': 'test-token',
 }
 
 describe('/api/sendgrid', () => {
   beforeEach(() => {
     sgMail.send.mockReset()
+    assertTurnstile.mockReset()
+    assertTurnstile.mockResolvedValue(true)
     jest.spyOn(console, 'log').mockImplementation(() => undefined)
     jest.spyOn(console, 'info').mockImplementation(() => undefined)
     jest.spyOn(console, 'warn').mockImplementation(() => undefined)
@@ -160,6 +173,21 @@ describe('/api/sendgrid', () => {
     expect(sgMail.send.mock.calls[0][0].html).not.toContain(
       '<script>alert(1)</script>'
     )
+    expect(sgMail.send.mock.calls[0][0].html).not.toContain(
+      'cf-turnstile-response'
+    )
+  })
+
+  it('rejects requests that fail Turnstile verification', async () => {
+    assertTurnstile.mockResolvedValue(false)
+    const response = responseMock()
+
+    await handler({ method: 'POST', body: validApplication }, response)
+
+    expect(response.statusCode).toBe(403)
+    expect(response.payload.message).not.toBe('success')
+    expect(sgMail.send).not.toHaveBeenCalled()
   })
 })
 
+

From 48b52ae6e673f22a3b20215cdf1b70843d39e650 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 10:42:58 +0100
Subject: [PATCH 05/18] style: fix prettier lint failures for Turnstile changes

---
 .../grant-application/TurnstileWidget.tsx      |  7 ++++++-
 pages/api/github.ts                            |  5 +----
 utils/application-submission.test.js           |  7 ++++---
 utils/getBlogLayout.ts                         |  4 +++-
 utils/turnstile.test.js                        | 18 +++++++++++-------
 5 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/components/grant-application/TurnstileWidget.tsx b/components/grant-application/TurnstileWidget.tsx
index 55184cf93..9577f5dca 100644
--- a/components/grant-application/TurnstileWidget.tsx
+++ b/components/grant-application/TurnstileWidget.tsx
@@ -87,7 +87,12 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
     )
 
     useEffect(() => {
-      if (!scriptReady || !SITE_KEY || !containerRef.current || !window.turnstile) {
+      if (
+        !scriptReady ||
+        !SITE_KEY ||
+        !containerRef.current ||
+        !window.turnstile
+      ) {
         return
       }
       if (widgetIdRef.current) return
diff --git a/pages/api/github.ts b/pages/api/github.ts
index 1102229f0..36649a26d 100644
--- a/pages/api/github.ts
+++ b/pages/api/github.ts
@@ -1,8 +1,5 @@
 import { NextApiRequest, NextApiResponse } from 'next/types'
-import {
-  assertTurnstile,
-  TURNSTILE_FAILURE_MESSAGE,
-} from '@/utils/turnstile'
+import { assertTurnstile, TURNSTILE_FAILURE_MESSAGE } from '@/utils/turnstile'
 
 const GH_ACCESS_TOKEN = process.env.GH_ACCESS_TOKEN
 const GH_ORG = process.env.GH_ORG
diff --git a/utils/application-submission.test.js b/utils/application-submission.test.js
index f69c21b7b..215094703 100644
--- a/utils/application-submission.test.js
+++ b/utils/application-submission.test.js
@@ -9,7 +9,9 @@ describe('submitApplication', () => {
   function turnstileMock(tokens) {
     let index = 0
     return {
-      waitForToken: jest.fn(async () => tokens[Math.min(index, tokens.length - 1)]),
+      waitForToken: jest.fn(
+        async () => tokens[Math.min(index, tokens.length - 1)]
+      ),
       reset: jest.fn(async () => {
         index += 1
         return tokens[Math.min(index, tokens.length - 1)]
@@ -70,8 +72,7 @@ describe('submitApplication', () => {
 
   it('forces a retry when GitHub returns a non-success response', async () => {
     const postJSON = jest.fn(async (url) => ({
-      message:
-        url === '/api/github' ? 'Application storage failed' : 'success',
+      message: url === '/api/github' ? 'Application storage failed' : 'success',
     }))
     const turnstile = turnstileMock(['token-1', 'token-2'])
 
diff --git a/utils/getBlogLayout.ts b/utils/getBlogLayout.ts
index c4eaba050..102bcacc8 100644
--- a/utils/getBlogLayout.ts
+++ b/utils/getBlogLayout.ts
@@ -17,6 +17,8 @@ export function getBlogLayout(post: Pick<Blog, 'layout' | 'tags'>): string {
   return DEFAULT_LAYOUT
 }
 
-export function isSpotlightLayout(post: Pick<Blog, 'layout' | 'tags'>): boolean {
+export function isSpotlightLayout(
+  post: Pick<Blog, 'layout' | 'tags'>
+): boolean {
   return getBlogLayout(post) === SPOTLIGHT_LAYOUT
 }
diff --git a/utils/turnstile.test.js b/utils/turnstile.test.js
index 2fc1b5bbc..063a4fd66 100644
--- a/utils/turnstile.test.js
+++ b/utils/turnstile.test.js
@@ -24,9 +24,9 @@ describe('turnstile helpers', () => {
   })
 
   it('reads the token field from the request body', () => {
-    expect(
-      getTurnstileToken({ [TURNSTILE_TOKEN_FIELD]: 'token-abc' })
-    ).toBe('token-abc')
+    expect(getTurnstileToken({ [TURNSTILE_TOKEN_FIELD]: 'token-abc' })).toBe(
+      'token-abc'
+    )
     expect(getTurnstileToken({ [TURNSTILE_TOKEN_FIELD]: '' })).toBeUndefined()
     expect(getTurnstileToken({})).toBeUndefined()
   })
@@ -72,14 +72,18 @@ describe('turnstile helpers', () => {
       }),
     })
 
-    await expect(verifyTurnstileToken('token', undefined, fetchImpl)).resolves.toBe(
-      false
-    )
+    await expect(
+      verifyTurnstileToken('token', undefined, fetchImpl)
+    ).resolves.toBe(false)
   })
 
   it('fails closed on network errors and missing secret or token', async () => {
     await expect(
-      verifyTurnstileToken('token', undefined, jest.fn().mockRejectedValue(new Error('net')))
+      verifyTurnstileToken(
+        'token',
+        undefined,
+        jest.fn().mockRejectedValue(new Error('net'))
+      )
     ).resolves.toBe(false)
 
     await expect(verifyTurnstileToken(undefined)).resolves.toBe(false)

From 2daf5901a8452da54d6eb462485922e773afc6e5 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 10:53:04 +0100
Subject: [PATCH 06/18] fix: clear stale Turnstile readiness and split reset
 APIs

Reset no longer enqueues waiters on fire-and-forget paths, and leaving
the final step clears turnstileReady so submit stays gated.
---
 .../MultiStepApplicationForm.tsx              | 13 ++++++++--
 .../grant-application/TurnstileWidget.tsx     | 15 +++++++++---
 utils/application-submission.test.js          | 24 +++++++++++--------
 utils/application-submission.ts               |  9 ++++---
 4 files changed, 41 insertions(+), 20 deletions(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index 6765262d4..289c0c88e 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -1,4 +1,4 @@
-import { ReactNode, useRef, useState } from 'react'
+import { ReactNode, useEffect, useRef, useState } from 'react'
 import { useRouter } from 'next/router'
 import { DefaultValues, useForm } from 'react-hook-form'
 import {
@@ -88,6 +88,15 @@ export default function MultiStepApplicationForm({
   }
 
   const isLastStep = currentStep === steps.length - 1
+
+  // Widget unmounts when leaving the last step; clear readiness so submit
+  // cannot stay enabled on a stale token when the user returns.
+  useEffect(() => {
+    if (!isLastStep) {
+      setTurnstileReady(false)
+    }
+  }, [isLastStep])
+
   const submitDisabled =
     !!submitRequiresChecked?.some((name) => !watch(name)) ||
     (isLastStep && !turnstileReady)
@@ -116,7 +125,7 @@ export default function MultiStepApplicationForm({
           : baseMessage
       )
       setTurnstileReady(false)
-      void turnstileRef.current?.reset()
+      turnstileRef.current?.reset()
     } finally {
       setLoading(false)
     }
diff --git a/components/grant-application/TurnstileWidget.tsx b/components/grant-application/TurnstileWidget.tsx
index 9577f5dca..726a64adc 100644
--- a/components/grant-application/TurnstileWidget.tsx
+++ b/components/grant-application/TurnstileWidget.tsx
@@ -33,7 +33,10 @@ declare global {
 export interface TurnstileWidgetHandle {
   getToken: () => string | undefined
   waitForToken: () => Promise<string>
-  reset: () => Promise<string>
+  /** Clear the current token and ask Turnstile for a new challenge. */
+  reset: () => void
+  /** Reset, then resolve once a fresh token is available. */
+  resetAndWaitForToken: () => Promise<string>
 }
 
 interface TurnstileWidgetProps {
@@ -73,8 +76,12 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
       if (widgetIdRef.current && window.turnstile) {
         window.turnstile.reset(widgetIdRef.current)
       }
+    }, [setToken])
+
+    const resetAndWaitForToken = useCallback(() => {
+      reset()
       return waitForToken()
-    }, [setToken, waitForToken])
+    }, [reset, waitForToken])
 
     useImperativeHandle(
       ref,
@@ -82,8 +89,9 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
         getToken: () => tokenRef.current,
         waitForToken,
         reset,
+        resetAndWaitForToken,
       }),
-      [reset, waitForToken]
+      [reset, resetAndWaitForToken, waitForToken]
     )
 
     useEffect(() => {
@@ -110,6 +118,7 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
           window.turnstile.remove(widgetIdRef.current)
           widgetIdRef.current = undefined
         }
+        setToken(undefined)
       }
     }, [scriptReady, setToken])
 
diff --git a/utils/application-submission.test.js b/utils/application-submission.test.js
index 215094703..eb3c675e6 100644
--- a/utils/application-submission.test.js
+++ b/utils/application-submission.test.js
@@ -8,15 +8,17 @@ describe('submitApplication', () => {
 
   function turnstileMock(tokens) {
     let index = 0
-    return {
-      waitForToken: jest.fn(
-        async () => tokens[Math.min(index, tokens.length - 1)]
-      ),
-      reset: jest.fn(async () => {
-        index += 1
-        return tokens[Math.min(index, tokens.length - 1)]
-      }),
-    }
+    const waitForToken = jest.fn(
+      async () => tokens[Math.min(index, tokens.length - 1)]
+    )
+    const reset = jest.fn(() => {
+      index += 1
+    })
+    const resetAndWaitForToken = jest.fn(async () => {
+      reset()
+      return waitForToken()
+    })
+    return { waitForToken, reset, resetAndWaitForToken }
   }
 
   it('creates the GitHub record before sending email, with fresh tokens', async () => {
@@ -35,7 +37,7 @@ describe('submitApplication', () => {
     ])
     expect(postJSON.mock.calls[0][1]['cf-turnstile-response']).toBe('token-1')
     expect(postJSON.mock.calls[1][1]['cf-turnstile-response']).toBe('token-2')
-    expect(turnstile.reset).toHaveBeenCalledTimes(1)
+    expect(turnstile.resetAndWaitForToken).toHaveBeenCalledTimes(1)
   })
 
   it('succeeds when GitHub is confirmed even if email fails', async () => {
@@ -68,6 +70,7 @@ describe('submitApplication', () => {
       expect.objectContaining({ 'cf-turnstile-response': 'token-1' })
     )
     expect(turnstile.reset).toHaveBeenCalled()
+    expect(turnstile.resetAndWaitForToken).not.toHaveBeenCalled()
   })
 
   it('forces a retry when GitHub returns a non-success response', async () => {
@@ -87,6 +90,7 @@ describe('submitApplication', () => {
     const turnstile = {
       waitForToken: jest.fn(async () => ''),
       reset: jest.fn(),
+      resetAndWaitForToken: jest.fn(),
     }
 
     await expect(
diff --git a/utils/application-submission.ts b/utils/application-submission.ts
index ef37da555..6a4aabe88 100644
--- a/utils/application-submission.ts
+++ b/utils/application-submission.ts
@@ -16,7 +16,8 @@ type PostJSON = (
 
 export interface TurnstileControls {
   waitForToken: () => Promise<string>
-  reset: () => Promise<string>
+  reset: () => void
+  resetAndWaitForToken: () => Promise<string>
 }
 
 export interface ApplicationDeliveryResult {
@@ -74,14 +75,12 @@ export async function submitApplication(
     withTurnstileToken(data, githubToken)
   )
   if (!github) {
-    if (turnstile) {
-      void turnstile.reset()
-    }
+    turnstile?.reset()
     throw new Error(SUBMISSION_ERROR)
   }
 
   const emailToken = turnstile
-    ? await turnstile.reset()
+    ? await turnstile.resetAndWaitForToken()
     : String(data[TURNSTILE_TOKEN_FIELD] || '')
 
   const email = await postSucceeded(

From ec50f201d8f9a8dd31b268e297da549c62b7e4af Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:18:49 +0100
Subject: [PATCH 07/18] fix: explain disabled submit when Turnstile is not
 ready

---
 .../MultiStepApplicationForm.tsx                | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index 289c0c88e..e9d8ceb48 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -154,10 +154,19 @@ export default function MultiStepApplicationForm({
       {steps[currentStep].render(stepProps)}
 
       {isLastStep && (
-        <TurnstileWidget
-          ref={turnstileRef}
-          onTokenChange={(token) => setTurnstileReady(!!token)}
-        />
+        <div className="space-y-2">
+          <TurnstileWidget
+            ref={turnstileRef}
+            onTokenChange={(token) => setTurnstileReady(!!token)}
+          />
+          {!turnstileReady && (
+            <p className="text-sm text-gray-600 dark:text-gray-300">
+              Complete the bot check above to enable submit. If nothing appears,
+              allow Cloudflare challenges or confirm this domain is listed on
+              the Turnstile widget.
+            </p>
+          )}
+        </div>
       )}
 
       <StepNavigation

From 78598e563cc54ae9e74a8ceba9f85a0f9a936bd5 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:28:40 +0100
Subject: [PATCH 08/18] chore: update Turnstile site key after domain refresh

---
 .env.example | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 7e83377b1..2fa352634 100644
--- a/.env.example
+++ b/.env.example
@@ -17,7 +17,7 @@ NEXT_PUBLIC_GOOGLE_DOC_ID=
 NEXT_PUBLIC_GOOGLE_API_KEY=
 
 # Cloudflare Turnstile (grant application forms)
-NEXT_PUBLIC_TURNSTILE_SITE_KEY=0x4AAAAAAEKByBDYEcxiPW-n
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=0x4AAAAAAEKG6l3R_rWeoGYT
 TURNSTILE_SECRET=
 
 # Fund-specific webhook secrets

From 5c2bc13cc78f687860a8715dacf9de17a696cd2f Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:35:49 +0100
Subject: [PATCH 09/18] fix: use implicit Turnstile render for dynamic grant
 forms

Explicit render never initialized when Script onLoad missed under
Next.js dynamic imports, leaving submit disabled with no widget.
---
 .../grant-application/TurnstileWidget.tsx     | 96 +++++++------------
 1 file changed, 37 insertions(+), 59 deletions(-)

diff --git a/components/grant-application/TurnstileWidget.tsx b/components/grant-application/TurnstileWidget.tsx
index 726a64adc..0a4a31ca2 100644
--- a/components/grant-application/TurnstileWidget.tsx
+++ b/components/grant-application/TurnstileWidget.tsx
@@ -5,28 +5,23 @@ import {
   useEffect,
   useImperativeHandle,
   useRef,
-  useState,
 } from 'react'
 
 const TURNSTILE_SCRIPT = 'https://challenges.cloudflare.com/turnstile/v0/api.js'
 const SITE_KEY = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY
+const CALLBACK_NAME = '__opensatsTurnstileCallback'
+const EXPIRED_CALLBACK_NAME = '__opensatsTurnstileExpired'
+const ERROR_CALLBACK_NAME = '__opensatsTurnstileError'
 
 declare global {
   interface Window {
     turnstile?: {
-      render: (
-        element: HTMLElement,
-        options: {
-          sitekey: string
-          action?: string
-          callback?: (token: string) => void
-          'expired-callback'?: () => void
-          'error-callback'?: () => void
-        }
-      ) => string
       reset: (widgetId?: string) => void
-      remove: (widgetId?: string) => void
+      ready?: (callback: () => void) => void
     }
+    [CALLBACK_NAME]?: (token: string) => void
+    [EXPIRED_CALLBACK_NAME]?: () => void
+    [ERROR_CALLBACK_NAME]?: () => void
   }
 }
 
@@ -43,26 +38,28 @@ interface TurnstileWidgetProps {
   onTokenChange?: (token: string | undefined) => void
 }
 
+/**
+ * Implicit-render Turnstile widget (Spin contract).
+ * Uses api.js without `render=explicit` so Cloudflare auto-mounts
+ * `.cf-turnstile` after the script loads — works with Next.js dynamic imports
+ * where Script `onLoad` can miss.
+ */
 const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
   function TurnstileWidget({ onTokenChange }, ref) {
-    const containerRef = useRef<HTMLDivElement>(null)
-    const widgetIdRef = useRef<string>()
     const tokenRef = useRef<string>()
     const waitersRef = useRef<Array<(token: string) => void>>([])
-    const [scriptReady, setScriptReady] = useState(false)
-
-    const setToken = useCallback(
-      (token: string | undefined) => {
-        tokenRef.current = token
-        onTokenChange?.(token)
-        if (token) {
-          const waiters = waitersRef.current
-          waitersRef.current = []
-          waiters.forEach((resolve) => resolve(token))
-        }
-      },
-      [onTokenChange]
-    )
+    const onTokenChangeRef = useRef(onTokenChange)
+    onTokenChangeRef.current = onTokenChange
+
+    const setToken = useCallback((token: string | undefined) => {
+      tokenRef.current = token
+      onTokenChangeRef.current?.(token)
+      if (token) {
+        const waiters = waitersRef.current
+        waitersRef.current = []
+        waiters.forEach((resolve) => resolve(token))
+      }
+    }, [])
 
     const waitForToken = useCallback(() => {
       if (tokenRef.current) return Promise.resolve(tokenRef.current)
@@ -73,9 +70,7 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
 
     const reset = useCallback(() => {
       setToken(undefined)
-      if (widgetIdRef.current && window.turnstile) {
-        window.turnstile.reset(widgetIdRef.current)
-      }
+      window.turnstile?.reset()
     }, [setToken])
 
     const resetAndWaitForToken = useCallback(() => {
@@ -95,32 +90,17 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
     )
 
     useEffect(() => {
-      if (
-        !scriptReady ||
-        !SITE_KEY ||
-        !containerRef.current ||
-        !window.turnstile
-      ) {
-        return
-      }
-      if (widgetIdRef.current) return
-
-      widgetIdRef.current = window.turnstile.render(containerRef.current, {
-        sitekey: SITE_KEY,
-        action: 'turnstile-spin-v2',
-        callback: (token) => setToken(token),
-        'expired-callback': () => setToken(undefined),
-        'error-callback': () => setToken(undefined),
-      })
+      window[CALLBACK_NAME] = (token: string) => setToken(token)
+      window[EXPIRED_CALLBACK_NAME] = () => setToken(undefined)
+      window[ERROR_CALLBACK_NAME] = () => setToken(undefined)
 
       return () => {
-        if (widgetIdRef.current && window.turnstile) {
-          window.turnstile.remove(widgetIdRef.current)
-          widgetIdRef.current = undefined
-        }
+        delete window[CALLBACK_NAME]
+        delete window[EXPIRED_CALLBACK_NAME]
+        delete window[ERROR_CALLBACK_NAME]
         setToken(undefined)
       }
-    }, [scriptReady, setToken])
+    }, [setToken])
 
     if (!SITE_KEY) {
       return (
@@ -132,16 +112,14 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
 
     return (
       <>
-        <Script
-          src={`${TURNSTILE_SCRIPT}?render=explicit`}
-          strategy="afterInteractive"
-          onLoad={() => setScriptReady(true)}
-        />
+        <Script src={TURNSTILE_SCRIPT} strategy="afterInteractive" />
         <div
-          ref={containerRef}
           className="cf-turnstile"
           data-sitekey={SITE_KEY}
           data-action="turnstile-spin-v2"
+          data-callback={CALLBACK_NAME}
+          data-expired-callback={EXPIRED_CALLBACK_NAME}
+          data-error-callback={ERROR_CALLBACK_NAME}
         />
       </>
     )

From 2dfedc5291234396ce3f3bf8dafb06ebda275fd5 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:46:10 +0100
Subject: [PATCH 10/18] fix: allow Cloudflare Turnstile in
 Content-Security-Policy

script-src and frame-src blocked challenges.cloudflare.com, so the
widget never loaded on apply forms.
---
 next.config.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/next.config.js b/next.config.js
index 0cc17d5e7..a5b8d953f 100644
--- a/next.config.js
+++ b/next.config.js
@@ -7,13 +7,13 @@ const withBundleAnalyzer = require('@next/bundle-analyzer')({
 // You might need to insert additional domains in script-src if you are using external services
 const ContentSecurityPolicy = `
   default-src 'self';
-  script-src 'self' 'unsafe-eval' 'unsafe-inline' giscus.app youtube.com http://www.youtube.com https://www.youtube.com cdn.usefathom.com;
+  script-src 'self' 'unsafe-eval' 'unsafe-inline' giscus.app youtube.com http://www.youtube.com https://www.youtube.com cdn.usefathom.com challenges.cloudflare.com https://challenges.cloudflare.com;
   style-src 'self' 'unsafe-inline';
   img-src * blob: data:;
   media-src 'self' youtube.com https://www.youtube.com;
   connect-src *;
   font-src 'self';
-  frame-src youtube.com https://www.youtube.com;
+  frame-src youtube.com https://www.youtube.com challenges.cloudflare.com https://challenges.cloudflare.com;
 `
 
 const securityHeaders = [

From df40c1676218e9c2247315e93dbbfb8e7c0fa066 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:54:23 +0100
Subject: [PATCH 11/18] style: center Turnstile widget with more vertical space

---
 components/grant-application/MultiStepApplicationForm.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index e9d8ceb48..7e6b998e8 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -154,13 +154,13 @@ export default function MultiStepApplicationForm({
       {steps[currentStep].render(stepProps)}
 
       {isLastStep && (
-        <div className="space-y-2">
+        <div className="my-8 flex flex-col items-center gap-3 py-2">
           <TurnstileWidget
             ref={turnstileRef}
             onTokenChange={(token) => setTurnstileReady(!!token)}
           />
           {!turnstileReady && (
-            <p className="text-sm text-gray-600 dark:text-gray-300">
+            <p className="max-w-md text-center text-sm text-gray-600 dark:text-gray-300">
               Complete the bot check above to enable submit. If nothing appears,
               allow Cloudflare challenges or confirm this domain is listed on
               the Turnstile widget.

From a2645c6f14ec6b7b668a8b8831ed17122db1e17b Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:55:17 +0100
Subject: [PATCH 12/18] chore: add preview-only ?step= shortcut for apply forms

---
 .../MultiStepApplicationForm.tsx              | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index 7e6b998e8..2c0067abd 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -28,6 +28,27 @@ interface MultiStepApplicationFormProps {
   submitRequiresChecked?: readonly string[]
 }
 
+/** Temporary: ?step=last|N on localhost and Vercel previews only. */
+function allowApplyStepShortcut() {
+  return (
+    process.env.NODE_ENV === 'development' ||
+    process.env.NEXT_PUBLIC_VERCEL_ENV === 'preview'
+  )
+}
+
+function stepIndexFromQuery(
+  stepParam: string | string[] | undefined,
+  stepCount: number
+): number | undefined {
+  if (typeof stepParam !== 'string' || stepCount < 1) return undefined
+  if (stepParam === 'last') return stepCount - 1
+  if (/^\d+$/.test(stepParam)) {
+    const index = Number(stepParam)
+    if (index >= 0 && index < stepCount) return index
+  }
+  return undefined
+}
+
 export default function MultiStepApplicationForm({
   steps,
   hiddenFields = {},
@@ -56,6 +77,15 @@ export default function MultiStepApplicationForm({
     defaultValues: { ...hiddenFields, ...defaultValues },
   })
 
+  // Temporary preview/dev shortcut: /apply/red?step=last
+  useEffect(() => {
+    if (!router.isReady || !allowApplyStepShortcut()) return
+    const index = stepIndexFromQuery(router.query.step, steps.length)
+    if (index !== undefined) {
+      setCurrentStep(index)
+    }
+  }, [router.isReady, router.query.step, steps.length])
+
   const scrollToTop = () => {
     formRef.current?.scrollIntoView({ behavior: 'smooth', block: 'start' })
   }

From 1561a21b8b64cbb428efd15bfb27853407ccc17e Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:57:09 +0100
Subject: [PATCH 13/18] style: remove Turnstile helper copy under apply submit

---
 .../grant-application/MultiStepApplicationForm.tsx       | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index 2c0067abd..6124f73b0 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -184,18 +184,11 @@ export default function MultiStepApplicationForm({
       {steps[currentStep].render(stepProps)}
 
       {isLastStep && (
-        <div className="my-8 flex flex-col items-center gap-3 py-2">
+        <div className="my-8 flex flex-col items-center py-2">
           <TurnstileWidget
             ref={turnstileRef}
             onTokenChange={(token) => setTurnstileReady(!!token)}
           />
-          {!turnstileReady && (
-            <p className="max-w-md text-center text-sm text-gray-600 dark:text-gray-300">
-              Complete the bot check above to enable submit. If nothing appears,
-              allow Cloudflare challenges or confirm this domain is listed on
-              the Turnstile widget.
-            </p>
-          )}
         </div>
       )}
 

From aace48379142d7e99db13628a94a6ac87ade15b6 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:58:16 +0100
Subject: [PATCH 14/18] style: left-align Turnstile widget on apply forms

---
 components/grant-application/MultiStepApplicationForm.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index 6124f73b0..afceb64a7 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -184,7 +184,7 @@ export default function MultiStepApplicationForm({
       {steps[currentStep].render(stepProps)}
 
       {isLastStep && (
-        <div className="my-8 flex flex-col items-center py-2">
+        <div className="my-8 py-2">
           <TurnstileWidget
             ref={turnstileRef}
             onTokenChange={(token) => setTurnstileReady(!!token)}

From 8c0c96a2fd1b08433c0428a1897a52db8e6597bb Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:58:35 +0100
Subject: [PATCH 15/18] style: center Turnstile widget on apply forms

---
 components/grant-application/MultiStepApplicationForm.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index afceb64a7..6124f73b0 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -184,7 +184,7 @@ export default function MultiStepApplicationForm({
       {steps[currentStep].render(stepProps)}
 
       {isLastStep && (
-        <div className="my-8 py-2">
+        <div className="my-8 flex flex-col items-center py-2">
           <TurnstileWidget
             ref={turnstileRef}
             onTokenChange={(token) => setTurnstileReady(!!token)}

From 7b87b2a147a573740161583919f9d3d9f9c02b2f Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 11:58:56 +0100
Subject: [PATCH 16/18] chore: remove temporary apply form ?step= shortcut

---
 .../MultiStepApplicationForm.tsx              | 30 -------------------
 1 file changed, 30 deletions(-)

diff --git a/components/grant-application/MultiStepApplicationForm.tsx b/components/grant-application/MultiStepApplicationForm.tsx
index 6124f73b0..8e0254f13 100644
--- a/components/grant-application/MultiStepApplicationForm.tsx
+++ b/components/grant-application/MultiStepApplicationForm.tsx
@@ -28,27 +28,6 @@ interface MultiStepApplicationFormProps {
   submitRequiresChecked?: readonly string[]
 }
 
-/** Temporary: ?step=last|N on localhost and Vercel previews only. */
-function allowApplyStepShortcut() {
-  return (
-    process.env.NODE_ENV === 'development' ||
-    process.env.NEXT_PUBLIC_VERCEL_ENV === 'preview'
-  )
-}
-
-function stepIndexFromQuery(
-  stepParam: string | string[] | undefined,
-  stepCount: number
-): number | undefined {
-  if (typeof stepParam !== 'string' || stepCount < 1) return undefined
-  if (stepParam === 'last') return stepCount - 1
-  if (/^\d+$/.test(stepParam)) {
-    const index = Number(stepParam)
-    if (index >= 0 && index < stepCount) return index
-  }
-  return undefined
-}
-
 export default function MultiStepApplicationForm({
   steps,
   hiddenFields = {},
@@ -77,15 +56,6 @@ export default function MultiStepApplicationForm({
     defaultValues: { ...hiddenFields, ...defaultValues },
   })
 
-  // Temporary preview/dev shortcut: /apply/red?step=last
-  useEffect(() => {
-    if (!router.isReady || !allowApplyStepShortcut()) return
-    const index = stepIndexFromQuery(router.query.step, steps.length)
-    if (index !== undefined) {
-      setCurrentStep(index)
-    }
-  }, [router.isReady, router.query.step, steps.length])
-
   const scrollToTop = () => {
     formRef.current?.scrollIntoView({ behavior: 'smooth', block: 'start' })
   }

From 910090e3b9c1047510f257a2cbe3f2f26c0906ee Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 14:11:22 +0100
Subject: [PATCH 17/18] fix: remount Turnstile and submit with a single token

Explicit-render the widget so leaving and returning to the last step
shows a fresh challenge. Send application emails from /api/github after
issue create so the form no longer waits for a second mid-submit verify.
---
 .../grant-application/TurnstileWidget.tsx     |  90 +++++++---
 pages/api/github.ts                           |   9 +
 pages/api/sendgrid.ts                         |  68 +------
 tests/api/github.test.js                      |  24 +++
 utils/application-emails.ts                   | 166 ++++++++++++++++++
 utils/application-submission.test.js          |  70 ++------
 utils/application-submission.ts               |  27 +--
 7 files changed, 296 insertions(+), 158 deletions(-)
 create mode 100644 utils/application-emails.ts

diff --git a/components/grant-application/TurnstileWidget.tsx b/components/grant-application/TurnstileWidget.tsx
index 0a4a31ca2..7ed937db2 100644
--- a/components/grant-application/TurnstileWidget.tsx
+++ b/components/grant-application/TurnstileWidget.tsx
@@ -7,7 +7,8 @@ import {
   useRef,
 } from 'react'
 
-const TURNSTILE_SCRIPT = 'https://challenges.cloudflare.com/turnstile/v0/api.js'
+const TURNSTILE_SCRIPT =
+  'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'
 const SITE_KEY = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY
 const CALLBACK_NAME = '__opensatsTurnstileCallback'
 const EXPIRED_CALLBACK_NAME = '__opensatsTurnstileExpired'
@@ -16,7 +17,18 @@ const ERROR_CALLBACK_NAME = '__opensatsTurnstileError'
 declare global {
   interface Window {
     turnstile?: {
+      render: (
+        element: HTMLElement,
+        options: {
+          sitekey: string
+          action?: string
+          callback?: (token: string) => void
+          'expired-callback'?: () => void
+          'error-callback'?: () => void
+        }
+      ) => string
       reset: (widgetId?: string) => void
+      remove: (widgetId?: string) => void
       ready?: (callback: () => void) => void
     }
     [CALLBACK_NAME]?: (token: string) => void
@@ -30,8 +42,6 @@ export interface TurnstileWidgetHandle {
   waitForToken: () => Promise<string>
   /** Clear the current token and ask Turnstile for a new challenge. */
   reset: () => void
-  /** Reset, then resolve once a fresh token is available. */
-  resetAndWaitForToken: () => Promise<string>
 }
 
 interface TurnstileWidgetProps {
@@ -39,13 +49,13 @@ interface TurnstileWidgetProps {
 }
 
 /**
- * Implicit-render Turnstile widget (Spin contract).
- * Uses api.js without `render=explicit` so Cloudflare auto-mounts
- * `.cf-turnstile` after the script loads — works with Next.js dynamic imports
- * where Script `onLoad` can miss.
+ * Explicit-render Turnstile widget so remounting the last apply step
+ * creates a fresh challenge (implicit render only mounts once).
  */
 const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
   function TurnstileWidget({ onTokenChange }, ref) {
+    const containerRef = useRef<HTMLDivElement>(null)
+    const widgetIdRef = useRef<string>()
     const tokenRef = useRef<string>()
     const waitersRef = useRef<Array<(token: string) => void>>([])
     const onTokenChangeRef = useRef(onTokenChange)
@@ -70,23 +80,19 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
 
     const reset = useCallback(() => {
       setToken(undefined)
-      window.turnstile?.reset()
+      if (widgetIdRef.current && window.turnstile) {
+        window.turnstile.reset(widgetIdRef.current)
+      }
     }, [setToken])
 
-    const resetAndWaitForToken = useCallback(() => {
-      reset()
-      return waitForToken()
-    }, [reset, waitForToken])
-
     useImperativeHandle(
       ref,
       () => ({
         getToken: () => tokenRef.current,
         waitForToken,
         reset,
-        resetAndWaitForToken,
       }),
-      [reset, resetAndWaitForToken, waitForToken]
+      [reset, waitForToken]
     )
 
     useEffect(() => {
@@ -102,6 +108,47 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
       }
     }, [setToken])
 
+    const mountWidget = useCallback(() => {
+      if (!SITE_KEY || !containerRef.current || !window.turnstile) return
+      if (widgetIdRef.current) return
+
+      widgetIdRef.current = window.turnstile.render(containerRef.current, {
+        sitekey: SITE_KEY,
+        action: 'turnstile-spin-v2',
+        callback: (token: string) => window[CALLBACK_NAME]?.(token),
+        'expired-callback': () => window[EXPIRED_CALLBACK_NAME]?.(),
+        'error-callback': () => window[ERROR_CALLBACK_NAME]?.(),
+      })
+    }, [])
+
+    useEffect(() => {
+      if (!SITE_KEY) return
+
+      let cancelled = false
+
+      const tryMount = () => {
+        if (cancelled) return
+        if (window.turnstile?.render) {
+          mountWidget()
+          return
+        }
+        window.turnstile?.ready?.(() => {
+          if (!cancelled) mountWidget()
+        })
+      }
+
+      tryMount()
+
+      return () => {
+        cancelled = true
+        if (widgetIdRef.current && window.turnstile?.remove) {
+          window.turnstile.remove(widgetIdRef.current)
+        }
+        widgetIdRef.current = undefined
+        setToken(undefined)
+      }
+    }, [mountWidget, setToken])
+
     if (!SITE_KEY) {
       return (
         <p className="text-sm text-red-600">
@@ -112,15 +159,12 @@ const TurnstileWidget = forwardRef<TurnstileWidgetHandle, TurnstileWidgetProps>(
 
     return (
       <>
-        <Script src={TURNSTILE_SCRIPT} strategy="afterInteractive" />
-        <div
-          className="cf-turnstile"
-          data-sitekey={SITE_KEY}
-          data-action="turnstile-spin-v2"
-          data-callback={CALLBACK_NAME}
-          data-expired-callback={EXPIRED_CALLBACK_NAME}
-          data-error-callback={ERROR_CALLBACK_NAME}
+        <Script
+          src={TURNSTILE_SCRIPT}
+          strategy="afterInteractive"
+          onLoad={mountWidget}
         />
+        <div ref={containerRef} />
       </>
     )
   }
diff --git a/pages/api/github.ts b/pages/api/github.ts
index 36649a26d..59a3ff21c 100644
--- a/pages/api/github.ts
+++ b/pages/api/github.ts
@@ -1,4 +1,5 @@
 import { NextApiRequest, NextApiResponse } from 'next/types'
+import { sendApplicationEmails } from '@/utils/application-emails'
 import { assertTurnstile, TURNSTILE_FAILURE_MESSAGE } from '@/utils/turnstile'
 
 const GH_ACCESS_TOKEN = process.env.GH_ACCESS_TOKEN
@@ -191,6 +192,14 @@ ${contactFooter}`
         labels: issueLabels,
       })
 
+      // Best-effort: GitHub record is the source of truth; email failure must
+      // not block a successful submit (avoids a second Turnstile mid-flight).
+      try {
+        await sendApplicationEmails(req.body)
+      } catch (emailErr) {
+        console.error('Application emails failed after issue create:', emailErr)
+      }
+
       res.status(200).json({ message: 'success' })
     } catch (err) {
       res.status(500).json({ statusCode: 500, message: (err as Error).message })
diff --git a/pages/api/sendgrid.ts b/pages/api/sendgrid.ts
index f99b74b86..7d4765483 100644
--- a/pages/api/sendgrid.ts
+++ b/pages/api/sendgrid.ts
@@ -1,15 +1,14 @@
 import { NextApiRequest, NextApiResponse } from 'next/types'
 import sgMail from '@sendgrid/mail'
 import { marked } from 'marked'
+import { sendApplicationEmails } from '@/utils/application-emails'
 import {
   assertTurnstile,
   TURNSTILE_FAILURE_MESSAGE,
-  TURNSTILE_TOKEN_FIELD,
 } from '@/utils/turnstile'
 
 const SENDGRID_API_KEY = process.env.SENDGRID_API_KEY
 const TO_ADDRESS = process.env.SENDGRID_RECIPIENT
-const CC_ADDRESS = process.env.SENDGRID_CC
 const BCC_ADDRESS = process.env.SENDGRID_BCC
 const FROM_ADDRESS = process.env.SENDGRID_VERIFIED_SENDER
 
@@ -250,15 +249,6 @@ export async function sendReportConfirmationEmail(
   return sendEmailWithRetry(msg)
 }
 
-function escapeHtml(value: unknown): string {
-  return String(value ?? '')
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;')
-}
-
 export default async function handler(
   req: NextApiRequest,
   res: NextApiResponse
@@ -276,68 +266,14 @@ export default async function handler(
     throw new Error('Env misconfigured')
   }
 
-  const body = Object.entries(req.body)
-    .filter(([key]) => key !== TURNSTILE_TOKEN_FIELD)
-    .map(
-      ([key, value]) => `<h3>${escapeHtml(key)}</h3><p>${escapeHtml(value)}</p>`
-    )
-    .join('')
-
-  const thankYouMessage = req.body.RED
-    ? `
-Thanks for your RED application. We've received it and are fast-tracking review. We'll follow up as soon as we can. Questions: red@opensats.org
-    `
-    : `
-Thank you for applying to OpenSats! 
-
-We have received your application and will evaluate it soon.
-This process can take 2-3 months, but in most cases it's faster.
-Feel free to reach out to applications@opensats.org if you have any questions.
-
-We will reach out again once we've made a decision. 
-Thank you for your patience.
-    `
-
-  const internalMessage = {
-    to: TO_ADDRESS,
-    cc: CC_ADDRESS,
-    from: FROM_ADDRESS,
-    subject: req.body.RED
-      ? `OpenSats RED: Application for ${req.body.project_name}`
-      : `OpenSats Application for ${req.body.project_name}`,
-    html: `${body}`,
-    text: body.replace(/<[^>]*>/g, ''),
-  }
-
-  const applicantMessage = {
-    to: `${req.body.email}`,
-    from: FROM_ADDRESS,
-    subject: req.body.RED
-      ? `Your OpenSats RED Application`
-      : `Your Application to OpenSats`,
-    html: `${thankYouMessage}`,
-    text: thankYouMessage,
-  }
-
-  const [internalSent, applicantSent] = await Promise.all([
-    sendEmailWithRetry(internalMessage),
-    sendEmailWithRetry(applicantMessage),
-  ])
+  const { internalSent, applicantSent } = await sendApplicationEmails(req.body)
 
   if (!internalSent) {
-    console.error('Application copy was not accepted by SendGrid')
     return res
       .status(502)
       .json({ message: 'Application email delivery failed' })
   }
 
-  if (!applicantSent) {
-    console.warn('Application stored, but applicant confirmation was not sent')
-  } else {
-    console.info('Application receipt sent')
-  }
-
-  console.info('Application copy sent to OpenSats')
   return res.status(200).json({
     message: 'success',
     applicantConfirmationSent: applicantSent,
diff --git a/tests/api/github.test.js b/tests/api/github.test.js
index c465f14da..f0352de07 100644
--- a/tests/api/github.test.js
+++ b/tests/api/github.test.js
@@ -24,8 +24,13 @@ jest.mock('@/utils/turnstile', () => {
   }
 })
 
+jest.mock('@/utils/application-emails', () => ({
+  sendApplicationEmails: jest.fn(),
+}))
+
 const { __create: createIssue } = require('@octokit/rest')
 const { assertTurnstile } = require('@/utils/turnstile')
+const { sendApplicationEmails } = require('@/utils/application-emails')
 const handler = require('../../pages/api/github.ts').default
 
 function responseMock() {
@@ -67,7 +72,13 @@ describe('/api/github', () => {
     createIssue.mockResolvedValue({ data: { number: 1 } })
     assertTurnstile.mockReset()
     assertTurnstile.mockResolvedValue(true)
+    sendApplicationEmails.mockReset()
+    sendApplicationEmails.mockResolvedValue({
+      internalSent: true,
+      applicantSent: true,
+    })
     jest.spyOn(console, 'log').mockImplementation(() => undefined)
+    jest.spyOn(console, 'error').mockImplementation(() => undefined)
   })
 
   afterEach(() => {
@@ -79,6 +90,18 @@ describe('/api/github', () => {
 
     await handler({ method: 'POST', body: validApplication }, response)
 
+    expect(response.statusCode).toBe(200)
+    expect(response.payload).toEqual({ message: 'success' })
+    expect(createIssue).toHaveBeenCalled()
+    expect(sendApplicationEmails).toHaveBeenCalledWith(validApplication)
+  })
+
+  it('still succeeds when application emails fail after issue create', async () => {
+    sendApplicationEmails.mockRejectedValue(new Error('SendGrid down'))
+    const response = responseMock()
+
+    await handler({ method: 'POST', body: validApplication }, response)
+
     expect(response.statusCode).toBe(200)
     expect(response.payload).toEqual({ message: 'success' })
     expect(createIssue).toHaveBeenCalled()
@@ -93,5 +116,6 @@ describe('/api/github', () => {
     expect(response.statusCode).toBe(403)
     expect(response.payload.message).not.toBe('success')
     expect(createIssue).not.toHaveBeenCalled()
+    expect(sendApplicationEmails).not.toHaveBeenCalled()
   })
 })
diff --git a/utils/application-emails.ts b/utils/application-emails.ts
new file mode 100644
index 000000000..d9b73794a
--- /dev/null
+++ b/utils/application-emails.ts
@@ -0,0 +1,166 @@
+import sgMail from '@sendgrid/mail'
+import { TURNSTILE_TOKEN_FIELD } from './turnstile'
+
+const SENDGRID_API_KEY = process.env.SENDGRID_API_KEY
+const TO_ADDRESS = process.env.SENDGRID_RECIPIENT
+const CC_ADDRESS = process.env.SENDGRID_CC
+const FROM_ADDRESS = process.env.SENDGRID_VERIFIED_SENDER
+
+if (SENDGRID_API_KEY) {
+  sgMail.setApiKey(SENDGRID_API_KEY)
+}
+
+interface EmailOptions {
+  to: string
+  subject: string
+  text: string
+  html: string
+  cc?: string
+  bcc?: string
+  from?: string
+}
+
+export interface ApplicationEmailResult {
+  internalSent: boolean
+  applicantSent: boolean
+}
+
+function escapeHtml(value: unknown): string {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;')
+}
+
+async function sendEmail(options: EmailOptions): Promise<boolean> {
+  if (!options.to || !options.subject || !options.text || !options.html) {
+    console.error('Missing required email fields:', {
+      to: !!options.to,
+      subject: !!options.subject,
+      text: !!options.text,
+      html: !!options.html,
+    })
+    return false
+  }
+
+  if (!SENDGRID_API_KEY) {
+    console.error('SendGrid API key not configured. Email not sent.')
+    return false
+  }
+
+  const { to, subject, text, html, cc, bcc, from } = options
+
+  try {
+    await sgMail.send({
+      to,
+      from: from || FROM_ADDRESS,
+      subject,
+      text,
+      html,
+      ...(cc ? { cc } : {}),
+      ...(bcc ? { bcc } : {}),
+      trackingSettings: {
+        clickTracking: { enable: false },
+        openTracking: { enable: false },
+        subscriptionTracking: { enable: false },
+      },
+    })
+    return true
+  } catch (error: unknown) {
+    console.error('Error sending email:', error)
+    return false
+  }
+}
+
+async function sendEmailWithRetry(
+  options: EmailOptions,
+  maxRetries = 3,
+  retryDelay = 1000
+): Promise<boolean> {
+  for (let attempts = 0; attempts < maxRetries; attempts++) {
+    try {
+      if (await sendEmail(options)) return true
+    } catch (error) {
+      console.error(`Email sending attempt ${attempts + 1} failed:`, error)
+    }
+    if (attempts + 1 < maxRetries) {
+      await new Promise((resolve) =>
+        setTimeout(resolve, retryDelay * (attempts + 1))
+      )
+    }
+  }
+  return false
+}
+
+/**
+ * Internal OpenSats copy + applicant thank-you for a grant application.
+ * Internal copy is required for a full email success; applicant is best-effort.
+ */
+export async function sendApplicationEmails(
+  body: Record<string, unknown>
+): Promise<ApplicationEmailResult> {
+  if (!SENDGRID_API_KEY || !TO_ADDRESS || !FROM_ADDRESS) {
+    console.error('SendGrid env misconfigured; application emails not sent.')
+    return { internalSent: false, applicantSent: false }
+  }
+
+  const htmlBody = Object.entries(body)
+    .filter(([key]) => key !== TURNSTILE_TOKEN_FIELD)
+    .map(
+      ([key, value]) => `<h3>${escapeHtml(key)}</h3><p>${escapeHtml(value)}</p>`
+    )
+    .join('')
+
+  const thankYouMessage = body.RED
+    ? `
+Thanks for your RED application. We've received it and are fast-tracking review. We'll follow up as soon as we can. Questions: red@opensats.org
+    `
+    : `
+Thank you for applying to OpenSats! 
+
+We have received your application and will evaluate it soon.
+This process can take 2-3 months, but in most cases it's faster.
+Feel free to reach out to applications@opensats.org if you have any questions.
+
+We will reach out again once we've made a decision. 
+Thank you for your patience.
+    `
+
+  const [internalSent, applicantSent] = await Promise.all([
+    sendEmailWithRetry({
+      to: TO_ADDRESS,
+      cc: CC_ADDRESS,
+      from: FROM_ADDRESS,
+      subject: body.RED
+        ? `OpenSats RED: Application for ${body.project_name}`
+        : `OpenSats Application for ${body.project_name}`,
+      html: htmlBody,
+      text: htmlBody.replace(/<[^>]*>/g, ''),
+    }),
+    sendEmailWithRetry({
+      to: `${body.email}`,
+      from: FROM_ADDRESS,
+      subject: body.RED
+        ? `Your OpenSats RED Application`
+        : `Your Application to OpenSats`,
+      html: thankYouMessage,
+      text: thankYouMessage,
+    }),
+  ])
+
+  if (!internalSent) {
+    console.error('Application copy was not accepted by SendGrid')
+  } else {
+    console.info('Application copy sent to OpenSats')
+  }
+
+  if (!applicantSent) {
+    console.warn('Application stored, but applicant confirmation was not sent')
+  } else {
+    console.info('Application receipt sent')
+  }
+
+  return { internalSent, applicantSent }
+}
diff --git a/utils/application-submission.test.js b/utils/application-submission.test.js
index eb3c675e6..0176626a7 100644
--- a/utils/application-submission.test.js
+++ b/utils/application-submission.test.js
@@ -6,78 +6,47 @@ const { submitApplication } = require('./application-submission.ts')
 describe('submitApplication', () => {
   const submission = { project_name: 'Test project' }
 
-  function turnstileMock(tokens) {
-    let index = 0
-    const waitForToken = jest.fn(
-      async () => tokens[Math.min(index, tokens.length - 1)]
-    )
-    const reset = jest.fn(() => {
-      index += 1
-    })
-    const resetAndWaitForToken = jest.fn(async () => {
-      reset()
-      return waitForToken()
-    })
-    return { waitForToken, reset, resetAndWaitForToken }
+  function turnstileMock(token) {
+    return {
+      waitForToken: jest.fn(async () => token),
+      reset: jest.fn(),
+    }
   }
 
-  it('creates the GitHub record before sending email, with fresh tokens', async () => {
+  it('creates the GitHub record with a Turnstile token', async () => {
     const postJSON = jest.fn().mockResolvedValue({ message: 'success' })
-    const turnstile = turnstileMock(['token-1', 'token-2'])
+    const turnstile = turnstileMock('token-1')
 
     await expect(
       submitApplication(submission, postJSON, turnstile)
     ).resolves.toEqual({
       github: true,
-      email: true,
     })
-    expect(postJSON.mock.calls.map((call) => call[0])).toEqual([
+    expect(postJSON).toHaveBeenCalledTimes(1)
+    expect(postJSON).toHaveBeenCalledWith(
       '/api/github',
-      '/api/sendgrid',
-    ])
-    expect(postJSON.mock.calls[0][1]['cf-turnstile-response']).toBe('token-1')
-    expect(postJSON.mock.calls[1][1]['cf-turnstile-response']).toBe('token-2')
-    expect(turnstile.resetAndWaitForToken).toHaveBeenCalledTimes(1)
-  })
-
-  it('succeeds when GitHub is confirmed even if email fails', async () => {
-    const postJSON = jest.fn(async (url) => ({
-      message: url === '/api/github' ? 'success' : 'Email delivery failed',
-    }))
-    const turnstile = turnstileMock(['token-1', 'token-2'])
-
-    await expect(
-      submitApplication(submission, postJSON, turnstile)
-    ).resolves.toEqual({
-      github: true,
-      email: false,
-    })
+      expect.objectContaining({ 'cf-turnstile-response': 'token-1' })
+    )
   })
 
-  it('forces a retry when GitHub fails and does not email anyone', async () => {
-    const postJSON = jest.fn(async (url) => {
-      if (url === '/api/github') throw new Error('GitHub unavailable')
-      return { message: 'success' }
+  it('forces a retry when GitHub fails', async () => {
+    const postJSON = jest.fn(async () => {
+      throw new Error('GitHub unavailable')
     })
-    const turnstile = turnstileMock(['token-1', 'token-2'])
+    const turnstile = turnstileMock('token-1')
 
     await expect(
       submitApplication(submission, postJSON, turnstile)
     ).rejects.toThrow('Please try again.')
     expect(postJSON).toHaveBeenCalledTimes(1)
-    expect(postJSON).toHaveBeenCalledWith(
-      '/api/github',
-      expect.objectContaining({ 'cf-turnstile-response': 'token-1' })
-    )
     expect(turnstile.reset).toHaveBeenCalled()
-    expect(turnstile.resetAndWaitForToken).not.toHaveBeenCalled()
   })
 
   it('forces a retry when GitHub returns a non-success response', async () => {
-    const postJSON = jest.fn(async (url) => ({
-      message: url === '/api/github' ? 'Application storage failed' : 'success',
-    }))
-    const turnstile = turnstileMock(['token-1', 'token-2'])
+    const postJSON = jest.fn().mockResolvedValue({
+      message: 'Application storage failed',
+    })
+    const turnstile = turnstileMock('token-1')
 
     await expect(
       submitApplication(submission, postJSON, turnstile)
@@ -90,7 +59,6 @@ describe('submitApplication', () => {
     const turnstile = {
       waitForToken: jest.fn(async () => ''),
       reset: jest.fn(),
-      resetAndWaitForToken: jest.fn(),
     }
 
     await expect(
diff --git a/utils/application-submission.ts b/utils/application-submission.ts
index 6a4aabe88..453b55705 100644
--- a/utils/application-submission.ts
+++ b/utils/application-submission.ts
@@ -17,12 +17,10 @@ type PostJSON = (
 export interface TurnstileControls {
   waitForToken: () => Promise<string>
   reset: () => void
-  resetAndWaitForToken: () => Promise<string>
 }
 
 export interface ApplicationDeliveryResult {
   github: boolean
-  email: boolean
 }
 
 export const SUBMISSION_ERROR =
@@ -59,34 +57,27 @@ export async function submitApplication(
   postJSON: PostJSON = fetchPostJSON,
   turnstile?: TurnstileControls
 ): Promise<ApplicationDeliveryResult> {
-  // Tokens are single-use: verify one for GitHub, then reset and verify
-  // another for SendGrid so siteverify does not reject timeout-or-duplicate.
-  const githubToken = turnstile
+  const token = turnstile
     ? await turnstile.waitForToken()
-    : String(data[TURNSTILE_TOKEN_FIELD] || '')
+    : typeof data[TURNSTILE_TOKEN_FIELD] === 'string'
+      ? (data[TURNSTILE_TOKEN_FIELD] as string)
+      : ''
 
-  if (!githubToken) {
+  if (!token) {
     throw new Error('Please complete the bot verification challenge.')
   }
 
+  // One Turnstile token: /api/github verifies and creates the issue, then
+  // sends application emails server-side (best-effort).
   const github = await postSucceeded(
     postJSON,
     '/api/github',
-    withTurnstileToken(data, githubToken)
+    withTurnstileToken(data, token)
   )
   if (!github) {
     turnstile?.reset()
     throw new Error(SUBMISSION_ERROR)
   }
 
-  const emailToken = turnstile
-    ? await turnstile.resetAndWaitForToken()
-    : String(data[TURNSTILE_TOKEN_FIELD] || '')
-
-  const email = await postSucceeded(
-    postJSON,
-    '/api/sendgrid',
-    withTurnstileToken(data, emailToken)
-  )
-  return { github, email }
+  return { github: true }
 }

From e33f3875b40ed26fb6c1acdc516969bfa2025ac2 Mon Sep 17 00:00:00 2001
From: Gigi <dergigi@pm.me>
Date: Sat, 8 Aug 2026 14:18:09 +0100
Subject: [PATCH 18/18] style: fix prettier lint on turnstile submit path

---
 pages/api/sendgrid.ts           | 5 +----
 utils/application-submission.ts | 4 ++--
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/pages/api/sendgrid.ts b/pages/api/sendgrid.ts
index 7d4765483..792a8fa23 100644
--- a/pages/api/sendgrid.ts
+++ b/pages/api/sendgrid.ts
@@ -2,10 +2,7 @@ import { NextApiRequest, NextApiResponse } from 'next/types'
 import sgMail from '@sendgrid/mail'
 import { marked } from 'marked'
 import { sendApplicationEmails } from '@/utils/application-emails'
-import {
-  assertTurnstile,
-  TURNSTILE_FAILURE_MESSAGE,
-} from '@/utils/turnstile'
+import { assertTurnstile, TURNSTILE_FAILURE_MESSAGE } from '@/utils/turnstile'
 
 const SENDGRID_API_KEY = process.env.SENDGRID_API_KEY
 const TO_ADDRESS = process.env.SENDGRID_RECIPIENT
diff --git a/utils/application-submission.ts b/utils/application-submission.ts
index 453b55705..fe5716bf4 100644
--- a/utils/application-submission.ts
+++ b/utils/application-submission.ts
@@ -60,8 +60,8 @@ export async function submitApplication(
   const token = turnstile
     ? await turnstile.waitForToken()
     : typeof data[TURNSTILE_TOKEN_FIELD] === 'string'
-      ? (data[TURNSTILE_TOKEN_FIELD] as string)
-      : ''
+    ? (data[TURNSTILE_TOKEN_FIELD] as string)
+    : ''
 
   if (!token) {
     throw new Error('Please complete the bot verification challenge.')