Business Logic: Free Trial/Quota Can Be Repeatedly Reclaimed After Account Deletion

[SecurityTalent]

Title Business Logic: Free Trial/Quota Can Be Repeatedly Reclaimed After Account Deletion

Type: Business Logic / Free-Trial Abuse

Summary

The same email address can repeatedly receive the free trial/free quota by deleting the existing account and registering again using the exact same email address.

I successfully reproduced this behavior multiple consecutive times using my own account and email address.

Steps to Reproduce

1. Create an account using test@example.com.
2. Receive the free trial/free quota.
3. Consume the available free entitlement.
4. Delete the account.
5. Register again using the same email address: test@example.com.
6. Verify the email if required.
7. Observe that the free trial/free quota is granted again.
8. Repeat the process multiple times.

Actual Result

The same email address can repeatedly reclaim the free entitlement after account deletion.

Impact

An attacker can repeatedly reclaim paid/free-tier resources without paying, potentially causing unlimited free access, revenue loss, and increased infrastructure/API costs. Due to the direct financial impact and repeatability, I believe this may warrant High severity and an appropriate bounty reward.

Reproducibility

100% — successfully reproduced multiple consecutive times using my own account and email address.

Suggested Fix

Persist free-trial/free-quota eligibility independently from the active account and prevent previously redeemed identities from receiving the same entitlement after account deletion and re-registration.

Evidence

I can provide screenshots or a screen recording demonstrating: https://youtu.be/-jHz1wvQXGE

• Initial free entitlement
• Consumption of the free quota
• Account deletion
• Re-registration using the same email
• Free entitlement being granted again
• Multiple successful repetitions

MD Mehedi hasan
Website: securitytalent.net
WP: 01960995649