Guides

Security

Protect credentials, delivery endpoints, and webhook integrity.

The one rule

Keep provider keys and VAPID private keys in a secrets manager or environment variables.
  • Enable TLS for SMTP authentication; requireTLS defaults to true when auth is set.
  • Verify provider webhook signatures before parsing trusted events.
  • Do not log email bodies, SMS bodies, or full push subscription endpoints.
  • Treat a push endpoint as a delivery token.

Webhooks

Vendor OTP helpers

Use OTP helpers only on concrete SMS transport instances.

Attachments

Attach bytes, strings, or runtime-supported file paths to email.