Validated requests
Strict request schemas and bounded bodies support predictable processing.
Engineering · Support Mail API A backend that turns app support requests into email.
An API-only backend for validated, rate-limited support requests from approved mobile applications.
THE PRODUCTThe problem
The problem
and the approach.
The challenge
A support form is also an untrusted network entry point. Missing validation can produce malformed emails, repeated taps can send duplicate messages and unrestricted attachments can be costly or unsafe to process. Email credentials and delivery decisions need to remain on the server.
The approach
A focused API accepts JSON from approved applications, validates and normalizes it, applies persistent rate limits and acquires a duplicate lock before sending. One optional supported image is decoded within bounds, stripped of metadata and re-encoded. SMTP stays server-side, and Redis retains abuse-control state and duplicate digests rather than support submissions. The backend has no public dashboard to illustrate with product screenshots.
Who it helps
Mobile applications that need to send user-initiated support requests without embedding SMTP credentials in the app.
A typical workflow
- An approved application submits the user’s support message and an optional image.
- The server validates the request, applies abuse controls and prepares a sanitized attachment if present.
- The mailer delivers the message through SMTP and returns a response for the app to handle.
Abuse controls
Persistent rate limits, duplicate locks, and honeypot handling protect the request path.
Email delivery
Escaped message bodies and sanitized optional image attachments are delivered through SMTP.
ENGINEERINGHow it
How it
is built.
Keeping mail credentials on the server
Approved mobile apps send support requests to a server endpoint instead of carrying SMTP credentials. The request path checks the origin when present, bounds the JSON body, validates it with Zod, and applies persistent rate limits before delivery. A claimed app identifier is part of validation, not proof that a caller is an authentic app installation.
Treating an attachment as untrusted input
An optional image is decoded with size and pixel limits, checked against its declared format, resized, and re-encoded as a new JPEG without the original metadata. The server chooses the attachment filename. This keeps client-supplied paths, filenames, and raw image metadata out of the delivered attachment.
Coordinating delivery and retries
An atomic Redis lock suppresses duplicate sends within its retention window. The request fingerprint uses a keyed digest. If SMTP fails, the service attempts to release the pending lock so a retry can proceed. Redis retains abuse-control state and duplicate digests; the support message is delivered by email rather than stored as a database record. These notes describe the source reviewed on October 17, 2026.
A focused backend project connecting approved applications to support email, with validation, abuse controls, and bounded attachment handling.
MORE PROJECTS
All projectsOther projects.
Hotel & room discovery Archived project
Pesona
/01An earlier hospitality interface for hotel discovery, package bookings and room sharing.
Remittance comparison Archived project
Rapid Remit
/02An earlier remittance comparison interface for exchange rates, provider fees and currency conversion.
FULL-TIME ROLESHiring a
CONTACT MEHiring a
React Native developer?
I’m open to full-time roles, remote or onsite.