Agent WranglersEmail security Recommended
Avoid risky attachments
Send only document types that are safe to open, such as PDF and images. Link to a signed-in download for anything private or large.
How to do it
Never attach programs, scripts or files with macros, such as .exe, .js, .bat or .docm. Gmail and Outlook block many of these types anyway. Keep attachments small, and name them clearly. Prefer a download link that checks the user is signed in.
How to check
List the attachment types your app can send. None is on the Gmail blocked file types list, and private documents go out as links.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/safe-attachments.