Repository navigation
fix(leads): stop cold outreach reaching opt-out and data-protection inboxes - #141
Merged
Merged
Conversation
…nboxes Live sends reached optout@, dpo@ and a candidate-accomodations@ queue. The guard was not missing — it ran, and it already listed unsubscribe, privacy and legal. It simply did not list optout, dpo, or anything accessibility-related, and a list of exact words does not generalise to its own near-synonyms. The fix is enumeration: opt-out variants, data protection, reporting and enforcement, accessibility queues, and hiring inboxes, including the misspelling the Activision address actually used. Exact matching was the second half of the problem. `accomodations` was blocked while `candidate-accomodations` was not, so the compound form went through. Matching now also splits the localpart on separators and checks each token. Splitting only on separators is what keeps this from over-blocking. A substring match would refuse privacyengineering@ and hrothgar@, which are ordinary addresses; as tokens they stay contactable. Shared business inboxes — hello@, info@, contact@, support@ — stay allowed too, since for a small company that is often the only address published and is a legitimate target, unlike anything on the list. The addresses in the test are the real ones that were mailed, kept verbatim so the case that failed is the case that is asserted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live sends reached these three addresses:
optout@dribbble.comdpo@ecoconsult.itcandidate-accomodations@activisionblizzard.comThe guard wasn't missing — its list was
NEVER_CONTACT_LOCALPARTran correctly and is applied in three places. It already listedunsubscribe,privacy, andlegal. It just didn't listoptout,dpo, or anything accessibility-related — and a list of exact words doesn't generalise to its own near-synonyms.Now enumerated: opt-out variants, data protection (
dpo,gdpr,compliance), reporting/enforcement, accessibility queues, and hiring inboxes — includingaccomodation, the misspelling the Activision address actually used.Exact matching was the second half
accomodationswas blocked whilecandidate-accomodationswas not. Matching now also splits the localpart on-._+and checks each token.Splitting only on separators is what prevents over-blocking. A substring match would refuse
privacyengineering@andhrothgar@— ordinary addresses that stay one token and stay contactable.Deliberately still allowed
hello@·info@·contact@·support@·sales@For a small company that's often the only published address and a legitimate B2B target. Over-blocking costs real prospects; these aren't in the same category as an opt-out queue.
Tests
The three leaked addresses are asserted verbatim, so the case that failed is the case that's covered — plus 20 category cases and 10 must-still-work cases.
tsc --noEmitclean🤖 Generated with Claude Code