---
title: "Avoid risky attachments · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-security/safe-attachments
updated: 2026-10-20
licence: "All rights reserved"
---

# Avoid risky attachments

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Email security](https://agentwranglers.se/playbook/email/email-security)
- Rule: Send only document types that are safe to open, such as PDF and images. Link to a signed-in download for anything private or large.
- How: Never attach programs, scripts or files with macros, such as `.exe`, `.js`, `.bat` or `.docm`. Gmail and Outlook block many of these types anyway. Keep attachments small, and name them clearly. Prefer a download link that checks the user is signed in.
- Check: List the attachment types your app can send. None is on the Gmail blocked file types list, and private documents go out as links.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/safe-attachments`.

- Previous: [Keep secrets out of email](https://agentwranglers.se/playbook/email/email-security/no-secrets-in-email)
- Next: [Send no scripts or forms in email](https://agentwranglers.se/playbook/email/email-security/active-content)
- [Email security](https://agentwranglers.se/playbook/email/email-security)