v0.3.0

Security hardening.

• Jinja2 templating uses a sandboxed environment, preventing SSTI/RCE via render_string (CWE-94/1336)
• All HTTP backends validate subject/sender/recipients and custom headers for CRLF/NUL (CWE-93)
• SNS notifications verify the message RSA signature against the AWS signing certificate (CWE-345)
• Secret config fields excluded from dataclass repr (CWE-532)
• validate_certs=False emits a warning before disabling TLS verification
• Provider error response bodies truncated in debug logs (CWE-532)

v0.2.0 — security hardening

Full OWASP review fixes. See CHANGELOG.md for details.

v0.1.0

Initial release.

Backends: SMTP (aiosmtplib), AWS SES (boto3, extras [ses]), SendGrid v3, Mailgun v3, Resend, in-memory.

Extras: Jinja2 templates, persistent outbox (SQLite) with retry worker, webhook signature verification + normalized events for all providers.

init_mail(app, ...) + Depends(get_mailer).