Annoying grey hat moron proves me my website needs captcha to protect my SaaS from himself

You know what’s funny? I’ve been running my SaaS for *years* without ever needing a CAPTCHA. Zero spam accounts. Zero bots. Everything was smooth. Then out of nowhere, this “grey hat” genius from Pakistan emails me like he’s doing me a favor: >“You should really add a CAPTCHA, I can create unlimited accounts.” Cool story, bro. So I ignore it. I've seen hundreds of e-mails from these so called grey/whitehat hackers with basic reports from vulnerability scanner software trying to make a dime....