Auth, billing, email and workflows. One SDK, one console.

Week of 12 October 2026

Spam protection for forms, deploy hooks that report back, and monday.com in the console

Forms can require a captcha and hold suspicious submissions for review. Deploy hooks and the monday.com integration, built but hidden until now, are in the console and working, and a workflow set to run every time no longer runs once per person.

• FormsForms can require a captcha, on the hosted page and in an embed, with no code to write. Pick a provider once under Forms > Spam protection, then switch on Require a captcha in a form's Protect dialog. The default, Managed by BuildBase, needs no keys or account, and your own Cloudflare Turnstile, hCaptcha or reCAPTCHA v2 Checkbox keys work too, with the secret encrypted at rest and never sent back to the console. Where the server has no Turnstile keys of its own, as a self-hosted install ships, Managed falls back to a proof of work the visitor's browser solves in about a second, with no third-party script or cookie: it makes every bot submission cost CPU time, but on its own it does not tell a person from a headless browser.
• FormsEvery form now drops the obvious bot traffic with nothing to switch on. Hosted and embedded forms carry a hidden field a person never fills, and a submission that fills it sees the usual success message and is never stored. The same content from the same address to the same form within ten minutes is stored once, so a retrying client no longer fires form.submitted twice. For spam that gets past a captcha, the Protect dialog adds a limit on links, up to 200 blocked words or phrases, a block on 70 known throwaway email domains or on your own list, and a daily cap. A link or word hit waits for review, badged with its reason such as "3 links (limit 1)", and reaches no webhook or workflow until someone approves it.
• FormsForms can be embedded in any website. A form's page has a Share and embed card with its link and an iframe snippet, and the embedded form resizes its frame as it grows and keeps its captcha and rules; until now the hosted form refused to load in a frame at all. A form you render yourself can carry the captcha too: the public form read names the widget and its site key, and the token travels in a _captcha field that is removed before the submission is stored or sent on. Require a captcha is off by default, because a form your own code posts sends no token until you add one, and on your own domain it needs the built-in check or your own keys, since the managed Turnstile key only works on BuildBase's own hostname.
• Deploy hooksDeploy hooks are in the console, under Settings > Configuration. Save a deploy hook URL from Vercel, Netlify, Cloudflare Pages or Render, and the banner at the top of the console lists the blog posts changed since the last deploy and starts a build on the hook you pick. The screens were built but had no menu entry, and no step worked: a hook's first deploy was refused, and hooks were called with a GET, which Netlify and Cloudflare Pages do not build on. Adding a hook now refuses a URL that cannot start a build, such as a site address or a provider's dashboard page, and the deployment history never returns a hook's URL, since anyone holding it can start a build. Three new docs pages, with screenshots, cover each provider.