Hijacking Email with Cloudflare Email Routing
> The restrictions were all client-side.<p>:-(<p>I've been in this industry since 1996. Must every programmer make this mistake for themselves before they learn? I see this over, and over, and over again, at company after company after company. I'm really surprised a company as seemingly competent as Cloudflare would make this mistake, to say nothing of the larger error of allowing forwarding to be setup on an unverified domain.<p>I weep.<p>Edit: I'd appreciate a response from Cloudflare on how this slipped through the cracks and what changes they are making to prevent such mistakes in the future. Not trusting user input is among the most basic thing I'd expect a programmer, especially one working at CF, to know in 2022, so I'm assuming this was some sort of miscommunication between teams.