Submission confirmation email sent within 5 minutes with a status link
Why it matters
When a submitter clicks submit and gets no email back, they assume the form dropped the request and either re-submit (creating duplicate moderation work) or abandon the directory entirely. Confirmation emails with a tracked submission ID and status link reduce duplicate submissions, cut support volume on "did you get my listing?" tickets, and give the business a legitimate re-engagement channel when the listing is approved. Absent confirmation also breaks CAN-SPAM and GDPR Article 13 transparency expectations around acknowledging data collection at the point of intake.
Severity rationale
High because missing confirmation drives duplicate submissions, support load, and transparency gaps without directly exposing data.
Remediation
In app/api/listings/submit/route.ts, generate a stable submission_id inside the same transaction that inserts the listing, then enqueue the confirmation email so the response is not blocked by SMTP latency. The email body must include the ID and a status URL the submitter can revisit:
await sendEmail({
to: data.contactEmail,
subject: 'Your listing submission has been received',
html: `Submission ID: ${submissionId}<br><a href="https://yourdomain.com/submissions/${submissionId}/status">Check Status</a>`
})
Queue the send via a background job so the API returns within 500ms.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the User Submissions & Moderation Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Information to be provided where personal data are collected from the data subject
Taxons
History
- 2026-04-18·v1.0.0·Initial import from directory-submissions-moderation·automated