Security best practices

​

Server-side only

​

Secret storage

import BosonMailClient from "@bosonware-ent/bosonmail";

const apiKey = process.env.BOSONMAIL_API_KEY;
if (!apiKey) throw new Error("BOSONMAIL_API_KEY is not set");

export const bosonmail = new BosonMailClient({ apiKey });

​

Do not log credentials

// Bad: may leak the key into logs
console.log(client);

// Good: log only safe metadata
console.log({ baseUrl: client.apiBaseUrl, timeout: client.timeoutMs });

​

Prevent open relay

• Authenticate send endpoints: only signed-in or authorized users should trigger emails.
• Fix the recipient server-side: for contact forms, do not let the user supply the to address. Hardcode it or map it from a trusted identifier.
• Rate limit: apply per-user or per-IP rate limits on endpoints that send email.
• Use CAPTCHA on public forms to reduce automated abuse.

​

Sanitize user input

function escapeHtml(text: string): string {
  return text
    .replace(/&/g, "&")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;");
}

const userName = escapeHtml(untrustedInput);
const html = `<p>Hello ${userName}</p>`;

​

Attachment safety

• Validate file types and sizes in your application before passing them to the SDK.
• Reject executable file types (.exe, .bat, .sh) at the application layer.
• Scan attachments with an antivirus or content scanner if your use case requires it.
• The SDK enforces a 10 MB per-file and 20 MB total limit, but application-level checks should run first.

​

HTTPS only

​

Dependency hygiene

• Pin the SDK version in package.json and use lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml).
• Run npm audit regularly.
• Verify the package name exactly: @bosonware-ent/bosonmail. Typosquatting is a real risk.
• Upgrade promptly when security fixes are released. See the Changelog for release notes.

​

Incident response

1. Revoke the key immediately via the dashboard or by contacting support@bosonware.com.
2. Rotate to a new key.
3. Audit recent sends and status checks for unexpected recipients or content.
4. Review application logs for signs of injection or abuse.

​

Legal and privacy

• BosonWare Terms of Service
• BosonWare Privacy Policy
• BosonWare SLA

​

Next steps