- Shipped
- October 14, 2026 at 4:24 PM UTC
- Author
- Kamo
- Commit
- 6fce139
SUSPICIOUS_SIGNIN_DETECTED joins the canonical templates. SecurityService's SuspiciousDetectionService sends it when a tenant-configured detection rule (failed-login threshold, geo anomaly, rapid IP switching, off-hours access, concurrent sessions) triggers with NOTIFY_ADMIN_EMAIL among its responses; until now that response only wrote a log line. Every attacker-influenced value uses its escaped twin (TemplateRenderer does no escaping). Carries the rule, the outcome, the account id, the address, the country and the responses applied; never credential material. SuspiciousSigninTemplateTest pins registration, seeding and the variable contract. EmailService seeds it once rebuilt onto this library.