diff --git a/server.js b/server.js
index 4fec2bb..e96ac59 100644
--- a/server.js
+++ b/server.js
@@ -715,7 +715,7 @@ const server = http.createServer(async (req, res) => {
       const who = (s && s.email) || '';
       const rec = await reports.add(b.campaignId, who, b.reason, b.note);
       try {
-        const adminEmail = siteConfig().adminEmail || process.env.ADMIN_EMAIL || '';
+        const adminEmail = process.env.ADMIN_EMAIL || ''; // private env only — siteConfig is exposed via /api/config
         if (adminEmail && mailer.hasKey()) {
           mailer.send(adminEmail, 'Ad reported on InstantAdPay (campaign #' + rec.campaignId + ')',
             'A member flagged an ad.\n\nCampaign: #' + rec.campaignId + '\nReason: ' + rec.reason