# Lead-Capture Form Backend (portfolio sample)

A small-business "Get a quote" form plus the backend that stores its submissions safely:
- **Validation.** Name, email format, message length and a required consent tick box.
- **Spam protection.** A hidden honeypot field silently drops bots, and each IP can send at most 5 submissions per 10 minutes (HTTP 429 after that).
- **Storage.** Leads go into a SQLite file. There's no third-party service and no monthly fee.
- **Owner export.** `GET /api/leads.csv` needs an `X-Admin-Token` header. Values are escaped so they can't run as formulas when opened in Excel (CSV injection).

```
pip install fastapi uvicorn
ADMIN_TOKEN=change-me uvicorn app:app --reload          # open http://127.0.0.1:8000/
curl -H "X-Admin-Token: change-me" http://127.0.0.1:8000/api/leads.csv
python test_app.py                                      # 13 automated tests
```
All data is fictional. For production, run it behind HTTPS, use a long random token, and add an email notification if you want one.