Description
In app/mailers/admin_mailer.rb:4-5:
default from: -> { ActionMailer::Base.email_address_with_name('admin@postcard.page', 'Postcard') },
to: -> { 'mail@philipithomas.com' }
Admin notification recipient is hard-coded. This can't be configured per environment and exposes a personal email in source code.
Recommendation
Move the admin email to an environment variable.
Severity
Medium