[Audit] Harden email SMTP TLS (requireTLS for STARTTLS)

[RaminNietzsche]

Background

Distinct from webhook SSRF (#426).

Problem

Email channel (server/services/notifications/channels/email.ts) configures Nodemailer with host/port/secure: port===465 only — no requireTLS for STARTTLS (587), enabling downgrade/cleartext risk.

Proposed solution

• Default requireTLS: true for non-465
• Env to allow insecure lab SMTP only
• Document recommended SMTP settings in PRODUCTION.md

Acceptance criteria

• Default refuses plain SMTP after STARTTLS failure
• Insecure mode requires explicit env
• Unit test for transport options

Priority

P2 / Medium

Complexity

Small

Evidence

server/services/notifications/channels/email.ts

[github-actions]

The issue highlights a security vulnerability in the email notification service, which uses Nodemailer without enforcing requireTLS for STARTTLS connections (port 587), potentially allowing downgrade or cleartext attacks. The proposed solution includes enforcing requireTLS by default for non-465 ports, providing an explicit environment variable for insecure lab environments, documenting SMTP configuration best practices, and implementing unit tests to validate transport options. This is categorized as a medium-priority, low-complexity fix.