Email & Communications

Without SPF, DKIM, and DMARC DNS records, anyone can send emails claiming to be from your domain — enabling phishing attacks against your users.

Including unvalidated user input in SMS messages allows attackers to inject newlines and craft fraudulent messages appearing to come from your application.

Including unsanitized user input in push notification payloads allows attackers to craft misleading notifications in your app's name.