Email delivery is tested and working
Why it matters
Sandbox SMTP credentials (Ethereal, Mailtrap, Resend test keys starting re_test_) accept messages and return a success response, then silently discard them. Password-reset emails never arrive, signup confirmations vanish, and paying customers cannot recover locked accounts. Support inboxes fill with I never got the email complaints that look like user error but are actually a missing production key. GDPR and CAN-SPAM also require functional unsubscribe mail that a sandbox swallows.
Severity rationale
High because broken transactional mail locks users out of their accounts and blocks revenue-critical flows.
Remediation
Swap sandbox keys for production credentials in your hosting platform's environment configuration — Resend re_ (not re_test_), SendGrid production API key, or Postmark server token. Verify the sender domain and publish DKIM, SPF, and DMARC records so Gmail and Outlook do not quarantine the mail. Then send one real test to an address you control, including a spam-folder check, for every flow: signup, password reset, receipts.
// lib/email.ts
import { Resend } from 'resend'
const resend = new Resend(process.env.RESEND_API_KEY)
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Pre-Launch Checklist Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from pre-launch·automated