I built a small solution for this that others here might find useful, so sharing in case it saves someone the trouble of building it themselves.
LimeSurvey's own End URL setting already supports everything needed — no plugin required                                                                                                          - For a token-based survey, add email={TOKEN:EMAIL} to your End URL and the participant's email carries straight through.
  - For an anonymous survey, add an email question and reference it the same way.From there you just need something on the receiving end that (a) verifies the request is genuine, (b) assigns the next available reward code, and (c) emails it — and does it idempotently, so a reload or resubmission never issues a second code.  I wrote exactly that as a small standalone service (REWARDR) since I needed it for a study I run myself — happy to share details if useful: . Not trying to spam the thread, just leaving this here since I searched for exactly this a while back and found nothing ready-made.

Seems interesting, but how do you disable such behaviour :

• I launch a survey, and I'm finally redirected to your website.
• Then, I create a bunch of emails that directly go to your website without doing the survey.
• A lot of money for me, and nothing for your client
• Your client loses money, you lose your client

PS: I disabled the directlink, I ask to administrator if we can leave it

Dank je wel voor het testen en het melden hiervan — je hebt helemaal gelijk, en dit was een echt probleem, geen theoretisch risico.

Het probleem: de secret in de link was hetzelfde voor elke deelnemer van dezelfde enquête. Zodra iemand de enquête één keer had ingevuld, kon diezelfde link — met alleen het e-mailadres aangepast — opnieuw gebruikt worden om extra beloningen te claimen, zonder de enquête opnieuw in te vullen.

Dit is inmiddels opgelost: elke link wordt nu gekoppeld aan het unieke antwoord-ID dat het enquêteplatform zelf meegeeft (bijv. LimeSurvey's {SAVEDID}). Zodra dat ID één keer gebruikt is, wordt een nieuwe poging met een ander e-mailadres geweigerd — een extra beloning vereist nu een echte, volledige nieuwe enquête-invulling, niet alleen een aangepaste link. Voor platforms zonder zo'n uniek ID is er een aanvullende controle op ongewoon snelle, herhaalde aanvragen vanaf hetzelfde IP-adres.

Wat mij betreft mag de directe link er weer op, als de beheerder daarmee akkoord is — het gedrag dat je beschreef werkt nu niet meer.

Nogmaals bedankt, dit soort feedback maakt het systeem echt beter.

Please only English in the English forum.

Thank you for testing this and for reporting the issue. You were absolutely right — this was a genuine security flaw, not just a theoretical risk.The root cause was that the secret embedded in the reward URL was the same for every participant of the same survey. Once a participant had completed the survey, the same URL could be reused with a different email address to claim additional rewards without completing the survey again.This has now been fixed. Each reward URL is now bound to the unique response ID generated by the survey platform itself, such as LimeSurvey’s {SAVEDID}. Once a response ID has been used to issue a reward, any subsequent request using that same ID is rejected, even if the email address has been changed.A new reward therefore requires a genuinely new and completed survey response. Simply modifying the email address in an existing URL is no longer sufficient.For platforms that do not provide a unique response ID, an additional anti-abuse check is applied to detect unusually fast and repeated requests from the same IP address.So, if the administrator agrees, the direct link can be added back. The specific vulnerability you identified has been addressed.Thank you again for testing this and bringing it to my attention. This kind of real-world testing is extremely valuable for improving the security and reliability of the system.

ErtanErsan wrote:

This has now been fixed. Each reward URL is now bound to the unique response ID generated by the survey platform itself, such as LimeSurvey’s {SAVEDID}. Once a response ID has been used to issue a reward, any subsequent request using that same ID is rejected, even if the email address has been changed. A new reward therefore requires a genuinely new and completed survey response. Simply modifying the email address in an existing URL is no longer sufficient.
 

I don't think this solves it for Limesurvey. SAVEDID is a consecutive number. If you only check if the SAVEDID is unique, one can change the email address in the link and put a SAVEDID that is higher than the current one (to make sure it hasn't been used to claim the incentive/reward) and you can still generate fraudulent end URLs.

Anyone who knows a little bit how those END-URLs work can figure this out quite quickly.