A form that echoes visitor text inside your signed email is a phishing relay
If a contact endpoint accepts a recipient and a message, and sends a branded, DKIM-signed email containing that message, anyone can send anything to anyone from your domain. A honeypot field stops bots that fill every input. It does not stop a person with curl.
Where it bit
The live contact form echoes visitor text in a Blinkz email to any address they supply, guarded by a honeypot. The frozen blinkz-v3 auto-reply worker was worse: its check was "if a secret is configured," and the forms never sent one, so the endpoint was open. The Cal.com branch had no signature check at all.
The practice
Recipients are never a request parameter. Visitor text goes to you, and the confirmation to them is a fixed template with no echoed body. Turnstile or an equivalent on anything that sends email. Signature check on every inbound webhook, with timingSafeEqual.
Check it
curl -s -X POST https://blinkz.ai/api/contact -H "Content-Type: application/json" \
-d '{"email":"someone-else@example.com","message":"click here: http://evil.example","website":""}'
# if that produces a Blinkz-branded email at someone-else, it is a relayGet this check as a script you can run tonight
What to do with this
If you run a business on something AI built and the checks came back with more than you expected, that is worth a conversation.
We do a free 30-minute Health Check for service businesses that want to know exactly where their biggest leaks are. No slide deck. No pitch. We ask questions, find the gaps, and tell you what we see. If there is no obvious fix, we will tell you that too.
Blinkz finds what is broken in how a business runs, then fixes it. AI only where it earns its place.