FormOS

Publishing creates an Airtable table with one column per question. Columns are added when you add questions — they are never renamed, retyped or deleted, because the question's immutable id lives in the column description and is the join key between the form and the data. Renaming a question's wording therefore costs nothing and breaks nothing. This is the rule that makes a live form safe to edit.

The rules that decide which question comes next are a single pure module. It runs in the browser to drive navigation, on the server to re-walk the path when a submission arrives, and under unit tests. Because the server re-walks it, answers to questions the respondent never actually reached are dropped rather than trusted — a hand-edited payload cannot disagree with the path.

A form can skip ahead, never back. That makes infinite loops impossible by construction rather than something to detect at run time. It is a smaller feature than the competition offers, and it is the reason the runner cannot hang.

So the email send, the webhook and the counter flush are all awaited before the response goes out, each one caught and time-bounded so none of them can fail a submission that was already recorded. Fire-and-forget work on this platform mostly does not happen — that had to shape the design rather than be discovered in production.

Webhook URLs are https-only and checked twice — once against literal private ranges when saved, and again by resolving the hostname at send time, so a public name that resolves to an internal address is refused. Redirects are not followed. Every request is HMAC-signed so the receiver can verify it came from the form.

A honeypot field, a too-fast-to-be-human timer, a short-term memory of recent respondents and a per-IP cap all return the same cheerful success screen. Nothing bounces, so there is nothing to tune against.