Comment by samus
4 years ago
We introduced an allowlist on all our testing and staging environments to ensure that only certain recipients can get email. We also make sure that no email address in these databases would work, unless we really want to send to it.
We did the same thing after that incident. It’s worked beautifully.