Merge fields sanitized to prevent header injection

Email header injection exploits the CRLF-based structure of the SMTP protocol. An attacker who can control a merge field value — say, a user's first name registered as Alice\r\nBcc: victim@example.com — can inject additional headers into outgoing emails, silently copying sends to arbitrary recipients. This maps to CWE-93 (CRLF injection) and OWASP A03 (Injection). Subject lines and Reply-To addresses built from unsanitized user input are the most common injection surfaces. The Compliance & Consent Engine category verifies that unsubscribe mechanisms exist — header injection is the vector by which those mechanisms can be bypassed.

Strip CR, LF, and null bytes from all user-controlled values placed in headers, and enforce a length cap, in lib/email/sanitize.ts:

export function sanitizeHeader(value: string): string {
  return value.replace(/[\r\n\0]/g, ' ').trim().slice(0, 256)
}

export function sanitizeEmailAddress(address: string): string {
  const clean = address.replace(/[\r\n\0<>]/g, '').trim()
  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(clean)) {
    throw new Error(`Invalid email address: ${clean}`)
  }
  return clean
}

Apply sanitizeHeader to every field that accepts user input before the value is passed to the ESP SDK — at minimum: subject, from name, and reply-to address.