From b9cb493ad6cc92f4fb84cb3d94c8aaa105a28836 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Tue, 23 Jun 2026 19:01:55 +0200 Subject: [PATCH] docs: verify email uses hosted QR image, not SMTP attachment Co-authored-by: Cursor --- 20260607-2FA-email-mobile-auth-flow.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/20260607-2FA-email-mobile-auth-flow.md b/20260607-2FA-email-mobile-auth-flow.md index 3bee835..5ed6ea0 100644 --- a/20260607-2FA-email-mobile-auth-flow.md +++ b/20260607-2FA-email-mobile-auth-flow.md @@ -209,7 +209,7 @@ Outbound (BE PHP): From: Android Cast Issues Reply-To: info@apps.f0xx.org SMTP: transactional relay (see §9.5) - Verify/reset links: always **`https://s.f0xx.org/…`** in the email body; attach **QR PNG** encoding the same short link with **`?src=qr`** for phone scan analytics + Verify/reset links: always **`https://s.f0xx.org/…`** in the email body; **inline QR** via **`https://s.f0xx.org/api/v1/qr/{slug}.png`** (encodes short link with **`?src=qr`**) — no PNG attachment (Gmail spam filter) ``` Document chosen provider in [`INFRA.md`](INFRA.md) § changelog once live.