SMS body includes date, time, and a short link to the booking detail page
Why it matters
An SMS that says "Your booking is confirmed" without the date, time, or a link to details forces the customer to open the app or website to find out when they need to show up. That friction is not cosmetic — customers forward confirmation SMSes to themselves as reminders, screenshot them, and share them with family. A generic message provides none of that utility. TCPA (47 U.S.C. § 227) requires an identification element in transactional SMS; a booking-specific link with a token also serves the dual purpose of providing one-click access to reschedule or cancel. A login-required URL collapses that utility for customers who are not currently authenticated.
Severity rationale
Medium because missing booking specifics in the SMS body creates a poor customer experience and increases inbound support contacts, without meeting the transactional informational standard TCPA implies.
Remediation
Update the SMS template in src/lib/sms-templates.ts to include all three required elements — date/time, timezone, and a short token-based link under 50 characters:
export function confirmationSmsTemplate(booking: Booking) {
const date = formatDate(booking.start_time, 'MMM d, h:mm a')
const tz = booking.timezone ?? 'UTC'
const link = `https://yoursite.com/b/${booking.short_id}` // ≤ 50 chars
return `Booking confirmed: ${date} ${tz}. Details: ${link}`
}
Verify the link target handles unauthenticated access via the short_id token — it must not redirect to a login page.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Booking Notifications & Reminders Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · TCPA-47-USC-227 — Telephone Consumer Protection Act — content and identification requirements for SMS
Taxons
History
- 2026-04-18·v1.0.0·Initial import from booking-notifications-reminders·automated