gonna guess this one's related to the frontend download/unzip feature, you could replace the captcha binary and call it through the api even if registration is disabled, so only cum.salon/btrfly would be affected