Posts on Newsletter.
3 posts tagged "Newsletter".
Scope the MySQL user first: the newsletter DDL as a security boundary on cPanel
On shared hosting, you don't control the firewall or the infrastructure. What you do control is which privileges the MySQL user holds. Scoping it to the newsletter schema alone made a compromised endpoint's blast radius structurally finite — not as a mitigation layered on top, but as a property of the design.
The confirm link token was in five places before the subscriber clicked it
Building newsletter confirm and unsubscribe handlers revealed a leak surface most developers overlook: tokens passed via GET end up in browser history, Referer headers, and server access logs before any mutation happens. The fix is an interstitial — show a page on GET, mutate only on POST.
Three newsletter hotfixes. The events table found all of them.
The newsletter form went live on 9 June. I subscribed from my own address and got nothing. No row, no email, no error. Three consecutive bugs followed, all found the same way: reading the events log, not the code.