Every submission gets a 0–100 spam score by default. The heuristic scorer (keyword blocklist, link density, entropy, injection detection) runs with zero keys; an LLM adds classification when a key is present.
Honeypot
Add a hidden `botcheck` field. Bots fill it; FormLoom marks those submissions spam and never emails them. Honeypot-blocked bots don't count against your usage.
Captcha
Optionally add Turnstile or hCaptcha per form by supplying your own site/secret keys. If unset, honeypot + AI scoring still run.