fix: block referral farming via disposable accounts (Closes #636)

[Priyanka0205-CSE]

What this fixes

Closes #636

The referral system credited +100 points the moment any new user signed up with a referral code, with no check on whether the new account was a real, distinct person. This let a user create disposable GitHub accounts and farm their own referral link indefinitely.

Changes

• firestore.rules: added refereeIsLegitimate() — requires the referee's own account to be ≥30 days old (measured from their GitHub account creation date) and have at least 1 public repo or follower, before any referral point credit is allowed.
• AuthContext.jsx: now captures githubCreatedAt, githubPublicRepos, githubFollowers, and a derived githubAccountAgeAtSignupDays at signup, so the rule above has something to check.
• Onboarding.jsx: split the referral crediting out of the account-creation transaction into a separate step that runs after the new user's own doc exists — this is required because Firestore security rules can't get() a document written earlier in the same transaction.

Testing

I don't have deploy access to the project's live Firebase instance, so I wasn't able to test this against the real database — the logic has been reasoned through carefully but hasn't been runtime-verified. Would appreciate a maintainer test before merge.

Note

A more robust fix (server-side validation via a Cloud Function, potentially with signup-IP correlation) was considered but the project doesn't currently have any Cloud Functions or admin backend infrastructure set up, so this PR uses a rules-only approach that needed no new infrastructure.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ranker-hub	Ready	Preview, Comment	Jul 18, 2026 6:05pm