From 3a6d9d037cc0c7d62313706e3ed6dc439a22a41d Mon Sep 17 00:00:00 2001 From: martbost Date: Mon, 7 Sep 2026 07:59:26 -0500 Subject: [PATCH] Ad-report admin recipient via ADMIN_EMAIL env only (siteConfig is public) Co-Authored-By: Claude Opus 4.8 --- server.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server.js b/server.js index 4fec2bb..e96ac59 100644 --- a/server.js +++ b/server.js @@ -715,7 +715,7 @@ const server = http.createServer(async (req, res) => { const who = (s && s.email) || ''; const rec = await reports.add(b.campaignId, who, b.reason, b.note); try { - const adminEmail = siteConfig().adminEmail || process.env.ADMIN_EMAIL || ''; + const adminEmail = process.env.ADMIN_EMAIL || ''; // private env only — siteConfig is exposed via /api/config if (adminEmail && mailer.hasKey()) { mailer.send(adminEmail, 'Ad reported on InstantAdPay (campaign #' + rec.campaignId + ')', 'A member flagged an ad.\n\nCampaign: #' + rec.campaignId + '\nReason: ' + rec.reason