From 9b104a22e7f2a20529d03695165dbfa5756aecdb Mon Sep 17 00:00:00 2001
From: Taesu <166604494+bytaesu@users.noreply.github.com>
Date: Thu, 1 Oct 2026 23:48:23 +0900
Subject: [PATCH] docs(captcha): clarify protected endpoints (#11511)

---
 docs/content/docs/plugins/captcha.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/content/docs/plugins/captcha.mdx b/docs/content/docs/plugins/captcha.mdx
index ef2ba5f558..143549ee16 100644
--- a/docs/content/docs/plugins/captcha.mdx
+++ b/docs/content/docs/plugins/captcha.mdx
@@ -157,7 +157,7 @@ Local development [allows requests by default](https://vercel.com/docs/botid/loc
 
 * **`provider` (required)**: your captcha provider.
 * **`secretKey` (required for all providers except `vercel-botid`)**: your provider's secret key used for the server-side validation.
-* `endpoints` (optional): replaces the default array of paths where captcha verification is enforced. If set, only the specified paths will be protected. Paths match exactly unless they include wildcards, such as `/sign-in/*` for one segment or `/sign-in/**` for nested routes. Default is `["/sign-up/email", "/sign-in/email", "/request-password-reset"]`.
+* `endpoints` (optional): Choose which paths require CAPTCHA. By default, CAPTCHA protects `/sign-up/email`, `/sign-in/email`, and `/request-password-reset`. Requests to other paths don't require CAPTCHA. When you set `endpoints`, include every path you want to protect because it replaces the defaults. You can use exact paths or wildcard patterns like `/sign-in/*` for one segment and `/sign-in/**` for nested routes.
 * `minScore` (optional - only *Google ReCAPTCHA v3*): minimum score threshold. Default is `0.5`.
 * `siteKey` (optional - only *hCaptcha* and *CaptchaFox*): prevents tokens issued on one sitekey from being redeemed elsewhere.
 * `siteVerifyURLOverride` (optional - token-based providers only): overrides the captcha verification URL.