config.ts isSenderAllowed returns true when the allowlist is empty (the default). SPF authenticates the sending domain, not authorization; intended source is Sentry alert mail only. Plan: default to a built-in Sentry sender allowlist, '' = reject-all, explicit '*' = allow-all, warn-log dropped mail, document in the knowledge doc.
Full self-contained implementation plan: plans/85-bug-handler-fail-closed-senders.md (audit round 4, planned at 070f5fe0a). Found by the 2026-07-10 deep audit.
config.ts isSenderAllowed returns true when the allowlist is empty (the default). SPF authenticates the sending domain, not authorization; intended source is Sentry alert mail only. Plan: default to a built-in Sentry sender allowlist, '' = reject-all, explicit '*' = allow-all, warn-log dropped mail, document in the knowledge doc.
Full self-contained implementation plan:
plans/85-bug-handler-fail-closed-senders.md(audit round 4, planned at070f5fe0a). Found by the 2026-07-10 deep audit.