[SECURITY][OUTBOUND EMAIL] Replace the arbitrary HTML admin relay with approved templates

[Obiajulu-gif]

Summary

Any administrator can submit arbitrary recipients, subject, and 50 KB of HTML directly to the email provider. A compromised admin session becomes a general-purpose phishing and tracking relay outside normal notification policy.

Repository evidence

• app/api/send-email/route.ts:27-31 accepts raw to, subject, and html.
• app/api/send-email/route.ts:68-70 forwards the HTML unchanged to sendEmail.

Scope

• Expose allowlisted template IDs with typed, escaped variables and recipient-policy checks.
• Require elevated approval for exceptional broadcasts and audit the template/version, not raw sensitive content.

Acceptance criteria

• Normal callers cannot submit arbitrary HTML or uncontrolled external recipients.
• Links, subjects, and variables are safely encoded and previewable.

Tests

• Cover HTML/script injection, remote tracking markup, recipient overflow, unauthorized templates, and approved sends.

Non-goals

• Building a marketing campaign platform.

[hardcordev]

I have experience with JavaScript/TypeScript and backend security. I’ll replace arbitrary HTML email input with approved templates, safely encode variables and recipients, and add tests for injection, unauthorized templates, recipient limits, and approved sends.

[grantfox-oss]

🦊 GrantFox — @hardcordev has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #194)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.