Emails flagged by member's security team

Alex Nassi said:

anyone else has experienced and addressed this before?

I am usually aware of issues with e-mail, but they tend to be 'rendering' problems, and also embedding JavaScript is often blocked.

This does appear to be an attack vector though: https://www.cloudflare.com/en-gb/threat-intelligence/research/report/svgs-the-hackers-canvas/ , (adjacent cve stating javascript can be embedded in svg https://nvd.nist.gov/vuln/detail/CVE-2025-28010 ) and on principle I disable sending the content of posts to the user, I only send the title, if anything.

I mainly do this so I'm not sending the user spam that's been posted onto the site, and with the recent UK Online Safety Act, stopping any illegitimate content before its sent to the user is paramount anyway.

I don't know if v13's e-mail studio would give you more granular control over this, but it does appear we need a 'filter' on content sent out that excludes file types.

I would raise this as a support ticket as I see it as crucial to the platform to give that level of control and security, someone could embed a malicious svg into the Community, and that could be sent to the user if you're not careful. Though you'll possibly be asked to raise it as an idea instead.

This is great, Christopher G. Stanton , very thorough, thank you so much! 

Christopher G. Stanton said:

on principle I disable sending the content of posts to the user, I only send the title, if anything.

I mainly do this so I'm not sending the user spam that's been posted onto the site,

Great point. The spam part is not as much of an issue on my site since I have moderation set for all users who are not already known contacts in our CRM (I'm not very concerned about our legitimate customers sending spam), but it could also be thought about from the engagement perspective. If I'm reading the body of an email notification and only have a title (or maybe the first 100-200 characters of the post), am I going to click through to read the whole post? Or am I going to ignore it and not go to the site, even if I may know the answer if I read further?

I probably need more insight from my site and members about how much traffic comes from email clicks versus people just being on the site and what member's workflows look like. 

Christopher G. Stanton said:

but it does appear we need a 'filter' on content sent out that excludes file types.

That'd be great, and ideally, some sort of indicator like "to see this [image], view this post online"

Christopher G. Stanton said:

I would raise this as a support ticket as I see it as crucial to the platform to give that level of control and security, someone could embed a malicious svg into the Community, and that could be sent to the user if you're not careful. Though you'll possibly be asked to raise it as an idea instead.

Good call, I'll raise it as a ticket and see what happens.

Thanks for the help!

This is great, Christopher G. Stanton , very thorough, thank you so much! 

Christopher G. Stanton said:

on principle I disable sending the content of posts to the user, I only send the title, if anything.

I mainly do this so I'm not sending the user spam that's been posted onto the site,

Great point. The spam part is not as much of an issue on my site since I have moderation set for all users who are not already known contacts in our CRM (I'm not very concerned about our legitimate customers sending spam), but it could also be thought about from the engagement perspective. If I'm reading the body of an email notification and only have a title (or maybe the first 100-200 characters of the post), am I going to click through to read the whole post? Or am I going to ignore it and not go to the site, even if I may know the answer if I read further?

I probably need more insight from my site and members about how much traffic comes from email clicks versus people just being on the site and what member's workflows look like. 

Christopher G. Stanton said:

but it does appear we need a 'filter' on content sent out that excludes file types.

That'd be great, and ideally, some sort of indicator like "to see this [image], view this post online"

Christopher G. Stanton said:

I would raise this as a support ticket as I see it as crucial to the platform to give that level of control and security, someone could embed a malicious svg into the Community, and that could be sent to the user if you're not careful. Though you'll possibly be asked to raise it as an idea instead.

Good call, I'll raise it as a ticket and see what happens.

Thanks for the help!