SA-2026-010: The subscriptions drain stored whatever arrived on a public lane

What it is

The lane's append token is public. The drain kept any JSON that decrypted: any keys, any email string, a note of any length. The checks were only in the browser form.

What an attacker could do

Header injection in mail, prompt injection into the sending agent, and junk in the subscriber list.

How: Encrypt a request by hand with the published key and post it, skipping the form.

Root cause

Validation lived in the client, which an attacker does not have to use.

What contributed

• Public append tokens are a deliberate design; their consequence had not been carried into the drains.

What was not in place

Server-side (drain-side) validation of every field.

The fix

Only the form's fields survive, checked against the site's lists; the note is kept as note_untrusted; floods are held.

What prevents it now

Every drain treats every row as hostile (REQUIREMENTS.md). What mail it can cause is SA-2026-027.