Some contact forms in the web have the "send me a copy of my email message" option which I personally find very comfortable.

Let's say that on my own website contact form I add this option, can this be a security breach? I mean, can a user, impersonating as a "potential customer" use this option to cause me trouble?

  • 1
    Not a security breach but it could be used for spamming others. You don't not know the real email address of the supposed potential customer, so anything can be given there. If this is attractive for distributing spam depends on how much influence the spammer has over the content of the message and if there is some protection against such abuse on the contact form, like captcha or rate limiting. Mar 27, 2021 at 5:16

1 Answer 1


Not realistically. If your email server is malicious and their SMTP server is vulnerable you could theoretically attack it that way, but frankly that's not a realistic attack; if it is possible, then you have bigger fish and the world has bigger problems then chasing one company. A slightly more likely vector is if you put malicious content in your form and the company fails to sanitize / escape the input correctly, resulting in an SMTP injection attack or similar (causing the company to send another email it didn't intend). That's still not very likely, though; SMTP isn't a complicated protocol and there are lots of libraries that can take arbitrary message headers and bodies and safely send them to SMTP servers.

Besides, companies send customers email all the time. For example, any time you create an account on a site, you'll probably get an email to confirm that you own the email address. If you actually order something, you'll get an emailed receipt. They'd love you to sign up for their marketing emails too. There's probably no important security concern that none of those companies have realized.

If you have some specific concern you want addressed, you should mention it in your question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .