Rejection reasons emailed to submitter with resubmission instructions
Why it matters
A rejected submission that generates no notification leaves the submitter with no recourse: they do not know the listing was rejected, why it failed, or how to fix it. This silently degrades the directory's submission funnel — legitimate businesses give up and post elsewhere. It also creates GDPR Art. 17 exposure if a user later requests deletion of data that was never communicated to them as rejected. The submitter's time and data were consumed with zero return.
Severity rationale
High because silent rejections destroy submitter trust, suppress resubmission of valid listings, and leave users unable to exercise data rights they don't know are triggered.
Remediation
Trigger a rejection email with reason and next steps as part of the moderation action. Tie it to the same API route that logs the action:
// app/api/admin/listings/[id]/moderate/route.ts
if (action === 'reject') {
await sendEmail({
to: listing.contact_email,
subject: `Your listing "${listing.title}" was not approved`,
html: `
<p><strong>Reason:</strong> ${reason}</p>
<p>To resubmit with corrections, visit:
<a href="${BASE_URL}/listings/resubmit?id=${listing.id}">Resubmit listing</a>.
</p>
<p>Questions? Reply to this email or contact support@yourdomain.com.</p>
`
})
}
Require reason to be non-empty when action is reject — enforce this at the API route level so moderators cannot submit a rejection without providing text.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the User Submissions & Moderation Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 17 — Right to Erasure / Right to be Forgotten
Taxons
History
- 2026-04-18·v1.0.0·Initial import from directory-submissions-moderation·automated