- Shipped
- September 11, 2026 at 8:53 PM UTC
- Author
- Kamo
- Commit
- d1eb088
A "pass it on" form at the foot of **************** reached from a chip at the top and a line after the seven questions. The reader names up to three people and we email each of them the article once, with the reader's name on it; they can also open it in their own mail client or copy the link instead. POST /api/share-article gates it before EmailService sees it: same-origin only, a *** verified server-side against the *** service (the other forms here forward the payload without anyone checking it), and self-send only for visitors in the EU/EEA, the UK and Switzerland. It forwards a body built from bounded fields, with the visitor address our ingress recorded, to EmailService's /api/internal/article-share, which enforces the limits and the platform org's opt-out list. Deployment reads INTERNAL_AUTH_SECRET from the existing mlos-internal-auth secret (optional, so the site still starts without it) and gains EMAIL_SERVICE_URL and CAPCHA_SERVICE_URL.