Source code Security & compliance

Header/recipient injection

Part of the Email safety check · fix arrives as a guide

What it is

A recipient address, subject, or header value is built from request input without validating it or stripping newline characters.

Why it matters

A newline in a header field lets the sender add headers of their own — extra Bcc recipients, a different Reply-To, or a second message body. Your domain and your reputation send it.

How to fix it

Reject any header value containing \r or \n, validate addresses against a strict parser before use, and pass recipients as structured arguments to the mail library rather than assembling header strings.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.