Repository navigation
[SECURITY][OUTBOUND EMAIL] Replace the arbitrary HTML admin relay with approved templates #194
Description
Summary
Any administrator can submit arbitrary recipients, subject, and 50 KB of HTML directly to the email provider. A compromised admin session becomes a general-purpose phishing and tracking relay outside normal notification policy.
Repository evidence
app/api/send-email/route.ts:27-31accepts rawto,subject, andhtml.app/api/send-email/route.ts:68-70forwards the HTML unchanged tosendEmail.
Scope
- Expose allowlisted template IDs with typed, escaped variables and recipient-policy checks.
- Require elevated approval for exceptional broadcasts and audit the template/version, not raw sensitive content.
Acceptance criteria
- Normal callers cannot submit arbitrary HTML or uncontrolled external recipients.
- Links, subjects, and variables are safely encoded and previewable.
Tests
- Cover HTML/script injection, remote tracking markup, recipient overflow, unauthorized templates, and approved sends.
Non-goals
- Building a marketing campaign platform.
Activity
hardcordev commentedon Aug 25, 2026
I have experience with JavaScript/TypeScript and backend security. I’ll replace arbitrary HTML email input with approved templates, safely encode variables and recipients, and add tests for injection, unauthorized templates, recipient limits, and approved sends.
grantfox-oss commentedon Aug 26, 2026
🦊 GrantFox — @hardcordev has been assigned to this issue as part of the Third Campaign campaign!
Next steps:
Closes #194)Good luck! Track your progress on GrantFox.
grantfox-oss commentedon Aug 28, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!
@hardcordev's PR #227 was approved and merged by @Obiajulu-gif.
🏆 @hardcordev: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (672 total points). Track your full progress on GrantFox.
👏 Great work, @hardcordev! Keep contributing to Chainmove.