BCC in email

[namandhakad712]

🔖 Enhancement description

Hi, when sending an email to a topic, all the recipients are visible in the "to:" field. From data security point of view it should be better to add them to BCC so that other recipients not know each others email. Or am I missing a setting?

🎤 Pitch

MUST BE

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct

[SharanRP]

I dug into the code and found the problem in the messaging worker. To fix it, we can change the batching logic so that emails to topics are sent individually (one per recipient), keeping everyone's address private. For regular messages, it still batches for speed.

$maxMessages = count($message->getAttribute('topics', [])) > 0 ? 1 : $adapter->getMaxMessagesPerRequest();

$batches = \array_chunk(
    \array_keys($identifiersForProvider),
    $maxMessages
);

Can you assign this issue to me so I can wrap it up ? If I'm off-base here, feel free to guide me!

[namandhakad712]

I cannot assign, the repo owners could only.

[SharanRP]

@tessamero can I work on this issue ?

[ChiragAgg5k]

@SharanRP individual sending of emails can take a really long time, a better solution would be to send BCC only mails. we have actually merged this in our adapter library - utopia-php/messaging#95

we just need to update the code to set a default recipient (you can configure this by a new env variable), and set the to field completely empty, instead opting to only bcc field

[SharanRP]

Got it, that makes sense.

[ooye-sanket]

Heyy all
My PR #11042 actually implements the BCC solution discussed here for batch email sending.

What it does:

• Uses BCC for all recipients (maintains privacy - recipients don't see each other)
• Only works when using the new batch API (setRecipients() method)
• Single recipient emails still work as before

Implementation:

• Primary recipient is set to sender's address (required by email APIs)
• All actual recipients are added as BCC - Recipients cannot see each other's email addresses

Check it out: #11042 cc @ChiragAgg5k @SharanRP @namandhakad712