From 6ab4d77ca9bebd01f75d8799dad23fdec7768b52 Mon Sep 17 00:00:00 2001 From: Dries Augustyns Date: Mon, 25 May 2026 18:16:07 +0200 Subject: [PATCH] feat(SecurityService): enhance phishing detection by verifying sender domains and institutional TLDs --- apps/api/src/services/SecurityService.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/api/src/services/SecurityService.ts b/apps/api/src/services/SecurityService.ts index fdc85f7..4f3bad6 100644 --- a/apps/api/src/services/SecurityService.ts +++ b/apps/api/src/services/SecurityService.ts @@ -765,7 +765,7 @@ export class SecurityService { const uniqueUrls = [...new Set(urlMatches.map(u => u.replace(/[.,;)]+$/, '')))].slice(0, 20); // Extract sender domain for context - const senderDomain = fromEmail.includes('@') ? fromEmail.split('@')[1].toLowerCase() : fromEmail.toLowerCase(); + const senderDomain = (fromEmail.split('@')[1] ?? fromEmail).toLowerCase(); // Check whether this domain is verified by the project. A verified // domain means the sender proved DNS/DKIM control — strong evidence of