feat: block subdomains of disposable email domains in isDisposableEmail

ddrayko · ddrayko · commit 698349635585 · 2026-07-20T11:39:13.000+02:00
diff --git a/services/security.js b/services/security.js
@@ -35,7 +35,7 @@ export async function isDisposableEmail(email) {
   if (parts.length !== 2) return false;
   const domain = parts[1].toLowerCase().trim();
   const domains = await loadDisposableDomains();
-  return domains.has(domain);
+  return domains.has(domain) || [...domains].some(d => domain.endsWith('.' + d));
 }
 
 export async function checkPasswordBreach(password) {

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ export async function isDisposableEmail(email) {`
`35`	`35`	`if (parts.length !== 2) return false;`
`36`	`36`	`const domain = parts[1].toLowerCase().trim();`
`37`	`37`	`const domains = await loadDisposableDomains();`
`38`		`- return domains.has(domain);`
	`38`	`+ return domains.has(domain) \|\| [...domains].some(d => domain.endsWith('.' + d));`
`39`	`39`	`}`
`40`	`40`
`41`	`41`	`export async function checkPasswordBreach(password) {`