Source code
Security & compliance
Header/recipient injection
Part of the Email safety check · fix arrives as a guide
What it is
A recipient address, subject, or header value is built from request input without validating it or stripping newline characters.
Why it matters
A newline in a header field lets the sender add headers of their own — extra Bcc recipients, a different Reply-To, or a second message body. Your domain and your reputation send it.
How to fix it
Reject any header value containing \r or \n, validate addresses against a strict parser before use, and pass recipients as structured arguments to the mail library rather than assembling header strings.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.