Security

Injection, dangerous content, phishing resistance, and secrets.

Email header injection prevention

Treat every header value as structured data, reject line breaks from untrusted input, and let a mail library serialize addresses and fields.

Link text, visible domains, redirects, and destination context must agree, while sensitive actions require fresh server-side authorization.

Do not depend on scripts, forms, embedded credentials, or untrusted active content; sanitise generated HTML and provide safe web fallbacks.