# Integrations & Mail Delivery Security

**Document Version:** 1.0.0 (Phase 15)

---

## 1. Secret Protection & Encryption

- **Encrypted At Rest:** Symmetrical encryption (`Crypt::encryptString`) for `smtp_password`.
- **Masked Display:** Passwords never rendered in HTML value attributes or JSON API payloads.
- **Log Sanitation:** Passwords excluded from application logs and exception stack traces.

---

## 2. Header & Content Sanitization

- **CRLF Injection Prevention:** `\r` and `\n` characters stripped from recipient email, recipient name, subject, and reply-to headers.
- **Template Security:** Variables evaluated strictly against known dictionary tokens without eval/code execution.
- **Strict Multi-Tenant Scoping:** Settings modifications and mail logs strictly isolated by `workspace_id`.