mirror of
https://github.com/screentinker/screentinker.git
synced 2026-06-18 20:22:42 -06:00
c0b220836a
The admin signup-notify recipient was hardcoded to support@screentinker.com and shipped in the open-source code. Combined with the opt-out SELF_HOSTED gate, any self-hoster who configured their own Graph credentials but forgot SELF_HOSTED=true would fire their users' signup PII (email, IP, country) into our support inbox. Source the recipient from ADMIN_NOTIFY_EMAIL instead, defaulting to null. When unset, the admin notification is skipped entirely and logged ("[SIGNUP-EMAIL] admin notify skipped (ADMIN_NOTIFY_EMAIL unset)"); the user's welcome email is unaffected. Hosted prod sets the env var so its notifications continue; self-hosters send nothing to us by default, and the .com address no longer ships in code. Document ADMIN_NOTIFY_EMAIL (and the related mail/self-host vars) in a new .env.example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| config | ||
| db | ||
| lib | ||
| middleware | ||
| player | ||
| routes | ||
| services | ||
| ws | ||
| .gitignore | ||
| config.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||