I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email.
Example: "Welcome to the Application, Your verification code is XXXXXX"
The purpose of sending the verification code in the subject is to make it easily accessible on mobile devices. Instead of opening the email, a user can simply see the code from the notification.
But with that, the verification code can be shown in the list of the emails. What are some other security risks here?
Real-life attack scenario: I am on a screen share call with my Boss, I know he intentionally enabled email push notifications on Desktop. I know the service he is using exposes the password reset verification code in the subject of the email. I try to reset there password via email. They receive a notification showing the 6 digit code. I quickly do what's currently going on your mind and đź’Ą