Security
Injection, dangerous content, phishing resistance, and secrets.
3 topics in this category.
About this category
This section collects production-verified specifications, implementation standards, and operational guidelines for security. Each specification provides clear compliance levels (Required, Recommended, Optional, or Avoid) alongside concrete testing methods and platform considerations.
Topics
Email Header Injection & CRLF Neutralization
RequiredPrevent SMTP and RFC 5322 header injection vulnerabilities by neutralizing CRLF control characters and using typed mail serialization libraries.
Secure Hyperlinks & Click-Tracking Integrity
RequiredEnforce HTTPS-only hyperlinks, eliminate phishing link text mismatches, and protect email click-tracking redirects against open redirect vulnerabilities using HMAC signatures.
Dangerous Content & Prohibited Email Elements
RequiredEliminate prohibited active content (JavaScript, iframes, embedded objects, raw forms) and restrict high-risk file attachment extensions to prevent malware classification.