zlacker

Sure you protect against that, but someone can also just send spam emails containing HTML since you don't sanitize it in any way.

1. get email list

2. write the prompt to be some spam email using HTML

3. use a captcha solving service and just flood your API, sending thousands of spam emails, destroying your mail reputation and possibly getting you banned from mailjet, for the low low price of a few dollars.

possibly worth fixing

>>KomoD+(OP)
yep, good point, I do need to sanitize the email. I do have bot detection and throttling enabled so not super worried about the email flooding. thanks for testing, you deserve a book!