Templates rendered server-side

Email template rendering that happens in the browser exposes your personalization logic, merge-field variable names, template structure, and potentially sensitive business rules to any user who opens DevTools. For SaaS products, this can reveal subscription tier logic, A/B test variants, or internal campaign identifiers embedded in templates. CWE-200 covers exposure of sensitive information to an unauthorized actor — shipping template compilation into the client bundle is the mechanism. OWASP A02 applies because the information asymmetry enables targeted attacks against the application's business logic.

Move all template rendering to server-side code — worker files, Next.js Server Actions, or API routes. In workers/email.worker.ts:

import Handlebars from 'handlebars'
import fs from 'fs'
import path from 'path'

const template = Handlebars.compile(
  fs.readFileSync(path.join(process.cwd(), 'templates', 'welcome.hbs'), 'utf-8')
)

export async function renderEmail(mergeFields: Record<string, string>): Promise<string> {
  return template(mergeFields) // Node.js only — never in a browser bundle
}

For React Email, call render() exclusively from 'use server' code or worker processes, never from a component file that could be included in the client bundle.