[HIGH] — `EmailService.send` logs the full rendered HTML body to console in development; may leak PII into log streams

[Alqku]

Severity: High
Type: Security hardening
Scope: Notifications
Labels: security, good first issue

Description

EmailService.send (src/notifications/email.service.ts, lines ~98–110) calls transporter.sendMail and, when the JSON transport is used (the dev fallback), it then logs the full message body via this.logger.debug(\Email body preview: ${(info as any).message}`). The (info as any).message` payload includes recipient addresses, subject, and full HTML, which frequently contains donor names, campaign titles, and donation amounts.

Even if intended only for debug level, default NestJS log level can be raised by LOG_LEVEL=debug in non-production environments; once collected by a log shipper (Datadog, Loki, CloudWatch), the body leaves the application boundary.

Recommendation

• In dev mode, log only the subject and recipient, never the HTML body.
• Mask any user-identifying fields (donor name, email) before logging the structured preview line.
• If a body preview is genuinely useful in dev, gate it behind an explicit EMAIL_PREVIEW=1 env flag and never honour it when NODE_ENV=production.

---

[Thosine-01]

Hi! I’d love to take on this security hardening task for your EmailService logging pipeline. I have strong experience implementing secure coding standards, managing sensitive data boundaries, and protecting internal logs against accidental PII leaks. I’ll start by refactoring the transporter.sendMail callback logic in src/notifications/email.service.ts to replace the raw message logging with a highly restricted, sanitized preview line.

I will implement a multi-layered guard: first, I’ll ensure that full HTML or message body previews are completely blocked when NODE_ENV=production. For local development environments, I’ll inject a masking utility that redacts donor names and filters email structures into safe placeholders (e.g., u***r@example.com) while keeping the subject line intact for developer context.

[grantfox-oss]

🦊 GrantFox — @Thosine-01 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #4)
2. Your PR will be reviewed by the OrbitChainLabs maintainers

Good luck! Track your progress on GrantFox.