Agent Wranglers

Email security Required

Keep secrets out of email

Never send passwords, full card numbers, ID numbers or API keys by email. Email is stored in many places and is hard to delete.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Show only the last four digits of a card or account. Send a link to a signed-in page for anything sensitive. If you must send a temporary credential, make it single use and short lived.

How to check

Search a sample of sent messages for card number and key patterns. None appears in full.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/no-secrets-in-email.