No per-recipient email send rate limit — same address can be spammed

[hman38705]

Labels: security, reliability, email

Priority: High

Description

src/email/service.rs does not enforce a per-recipient send rate limit. If idempotency is bypassed (e.g., different template, different idempotency key), the same email address can receive unbounded messages within a short window.

Acceptance Criteria

• Add a per-recipient Redis key rate limit: max N emails per recipient per hour (configurable via EMAIL_PER_RECIPIENT_HOURLY_LIMIT)
• Enforce this limit before enqueueing any email job
• Return a structured error when the limit is exceeded so callers can surface a user-friendly message
• Add a test verifying the Nth+1 email send is rejected

[Deyanju23]

@Deyanju23 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can i work on this please?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Deyanju23 to this issue.

[edwarddavid929-png]

@edwarddavid929-png has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

hello i would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @edwarddavid929-png to this issue.

[drips-wave]

Congratulations, @edwarddavid929-png! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @edwarddavid929-png: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊