Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Some contact forms in the web have the "send me a copy of my email message" option which I personally find very comfortable.
Let's say that on my own website contact form I add this option, can this be a security breach? I mean, can a user, impersonating as a "potential customer" use this option to cause me trouble?
Not realistically. If your email server is malicious and their SMTP server is vulnerable you could theoretically attack it that way, but frankly that's not a realistic attack; if it is possible, then you have bigger fish and the world has bigger problems then chasing one company. A slightly more likely vector is if you put malicious content in your form and the company fails to sanitize / escape the input correctly, resulting in an SMTP injection attack or similar (causing the company to send another email it didn't intend). That's still not very likely, though; SMTP isn't a complicated protocol and there are lots of libraries that can take arbitrary message headers and bodies and safely send them to SMTP servers.
Besides, companies send customers email all the time. For example, any time you create an account on a site, you'll probably get an email to confirm that you own the email address. If you actually order something, you'll get an emailed receipt. They'd love you to sign up for their marketing emails too. There's probably no important security concern that none of those companies have realized.
If you have some specific concern you want addressed, you should mention it in your question.
