README.md

@@ -202,8 +202,8 @@ sign up and log in. Abuse is limited by what a new account can do, not by a chal
 - **Registration switches** (in `.env` / `app.ini`):
   - `DISABLE_REGISTRATION=true`: invite-only.
   - `REGISTER_EMAIL_CONFIRM=true`: only once `[mailer]` works.
-  - `REGISTER_MANUAL_CONFIRM = true`: emergency switch that holds every new account until an admin
-    activates it.
+  - `REGISTER_MANUAL_CONFIRM = true`: holds new web sign-ups until an admin activates them. It does
+    not hold accounts created through the admin API and does not slow password guessing.
   - `[service] EMAIL_DOMAIN_ALLOWLIST` / `EMAIL_DOMAIN_BLOCKLIST`: restrict sign-up email domains.
 - **Edge rate limit:** a rate-limit rule at your proxy or CDN on `POST /user/sign_up` and
   `POST /user/login` (for example, a few requests per minute per IP). Gitea 1.23 has no built-in
@@ -216,13 +216,6 @@ Known gaps:
 
 ### Rollout order (existing instance with a captcha)
 
-> **Hosted instance (gitea.seamtro.ai), 15 Oct 2026:** the owner chose to skip the edge-rate-limit
-> gate below until there is actual abuse, and turned the captcha off with password basic auth still
-> on. If abuse appears, the emergency switch is `REGISTER_MANUAL_CONFIRM = true` plus a restart, which
-> holds new accounts for admin activation. Then add the edge rules in step 1 and 2.
-> Self-hosters should still follow the order below.
-
-
 1. Add the edge rate limit on `POST /user/sign_up` and `POST /user/login`, and verify it: a burst
    from one IP gets 429.
 2. **Gate while password basic auth is still on.** If `ENABLE_BASIC_AUTHENTICATION` must stay `true`

config/app.ini.template

@@ -90,7 +90,7 @@ REQUIRE_CAPTCHA_FOR_LOGIN = false
 ENABLE_BASIC_AUTHENTICATION = false
 ; Only turn this on once [mailer] really delivers mail.
 REGISTER_EMAIL_CONFIRM = ${REGISTER_EMAIL_CONFIRM}
-; Emergency switch: set true to hold new sign-ups until an admin activates them.
+; Holds new web sign-ups until an admin activates them (not admin-API-created accounts; no effect on password guessing).
 REGISTER_MANUAL_CONFIRM = false
 ALLOW_ONLY_EXTERNAL_REGISTRATION = false
 ; Public repos stay browsable without an account.