thuban 0.3.3 → 0.4.0

package/dist/packages/crucible/seeds/rust/seed-048 3.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: high
+// language: rust
+// expected: Secret from env var logged to stdout/stderr — credential exposure in logs
+
+use std::env;
+
+pub fn initialize_client() {
+    let api_key = env::var("API_KEY").expect("API_KEY not set");
+    let db_password = env::var("DB_PASSWORD").expect("DB_PASSWORD not set");
+    println!("Starting client with API_KEY={}", api_key);
+    eprintln!("DB connection using password: {}", db_password);
+    log::info!("Auth token: {}", env::var("AUTH_TOKEN").unwrap_or_default());
+}
+
+pub fn debug_config() {
+    for (key, value) in env::vars() {
+        println!("{}={}", key, value);
+    }
+}

package/dist/packages/crucible/seeds/rust/seed-048.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: high
+// language: rust
+// expected: Secret from env var logged to stdout/stderr — credential exposure in logs
+
+use std::env;
+
+pub fn initialize_client() {
+    let api_key = env::var("API_KEY").expect("API_KEY not set");
+    let db_password = env::var("DB_PASSWORD").expect("DB_PASSWORD not set");
+    println!("Starting client with API_KEY={}", api_key);
+    eprintln!("DB connection using password: {}", db_password);
+    log::info!("Auth token: {}", env::var("AUTH_TOKEN").unwrap_or_default());
+}
+
+pub fn debug_config() {
+    for (key, value) in env::vars() {
+        println!("{}={}", key, value);
+    }
+}

package/dist/packages/crucible/seeds/rust/seed-049 2.rs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: high
+// language: rust
+// expected: Environment variable values reflected in HTTP response — credential leak
+
+use axum::{response::IntoResponse, http::StatusCode};
+use std::env;
+
+pub async fn debug_handler() -> impl IntoResponse {
+    let config = serde_json::json!({
+        "database_url": env::var("DATABASE_URL").unwrap_or_default(),
+        "redis_url": env::var("REDIS_URL").unwrap_or_default(),
+        "api_key": env::var("API_KEY").unwrap_or_default(),
+        "jwt_secret": env::var("JWT_SECRET").unwrap_or_default(),
+        "aws_key": env::var("AWS_ACCESS_KEY_ID").unwrap_or_default(),
+        "aws_secret": env::var("AWS_SECRET_ACCESS_KEY").unwrap_or_default(),
+    });
+    (StatusCode::OK, config.to_string())
+}
+
+pub fn get_env_or_log(key: &str) -> String {
+    let value = env::var(key).unwrap_or_default();
+    log::debug!("Reading env {} = {}", key, value);
+    value
+}

package/dist/packages/crucible/seeds/rust/seed-049 3.rs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: high
+// language: rust
+// expected: Environment variable values reflected in HTTP response — credential leak
+
+use axum::{response::IntoResponse, http::StatusCode};
+use std::env;
+
+pub async fn debug_handler() -> impl IntoResponse {
+    let config = serde_json::json!({
+        "database_url": env::var("DATABASE_URL").unwrap_or_default(),
+        "redis_url": env::var("REDIS_URL").unwrap_or_default(),
+        "api_key": env::var("API_KEY").unwrap_or_default(),
+        "jwt_secret": env::var("JWT_SECRET").unwrap_or_default(),
+        "aws_key": env::var("AWS_ACCESS_KEY_ID").unwrap_or_default(),
+        "aws_secret": env::var("AWS_SECRET_ACCESS_KEY").unwrap_or_default(),
+    });
+    (StatusCode::OK, config.to_string())
+}
+
+pub fn get_env_or_log(key: &str) -> String {
+    let value = env::var(key).unwrap_or_default();
+    log::debug!("Reading env {} = {}", key, value);
+    value
+}

package/dist/packages/crucible/seeds/rust/seed-049.rs

@@ -0,0 +1,26 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: high
+// language: rust
+// expected: Environment variable values reflected in HTTP response — credential leak
+
+use axum::{response::IntoResponse, http::StatusCode};
+use std::env;
+
+pub async fn debug_handler() -> impl IntoResponse {
+    let config = serde_json::json!({
+        "database_url": env::var("DATABASE_URL").unwrap_or_default(),
+        "redis_url": env::var("REDIS_URL").unwrap_or_default(),
+        "api_key": env::var("API_KEY").unwrap_or_default(),
+        "jwt_secret": env::var("JWT_SECRET").unwrap_or_default(),
+        "aws_key": env::var("AWS_ACCESS_KEY_ID").unwrap_or_default(),
+        "aws_secret": env::var("AWS_SECRET_ACCESS_KEY").unwrap_or_default(),
+    });
+    (StatusCode::OK, config.to_string())
+}
+
+pub fn get_env_or_log(key: &str) -> String {
+    let value = env::var(key).unwrap_or_default();
+    log::debug!("Reading env {} = {}", key, value);
+    value
+}

package/dist/packages/crucible/seeds/rust/seed-050 2.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: critical
+// language: rust
+// expected: User-controlled key used to read arbitrary env var — information disclosure
+
+use std::env;
+use axum::{extract::Query, response::IntoResponse};
+use std::collections::HashMap;
+
+pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let key = params.get("key").cloned().unwrap_or_default();
+    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
+    format!("{}={}", key, value)
+}
+
+pub fn lookup_env(user_key: &str) -> String {
+    env::var(user_key).unwrap_or_default()
+}
+
+pub fn set_env_from_input(name: &str, value: &str) {
+    unsafe { env::set_var(name, value) }
+}

package/dist/packages/crucible/seeds/rust/seed-050 3.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: critical
+// language: rust
+// expected: User-controlled key used to read arbitrary env var — information disclosure
+
+use std::env;
+use axum::{extract::Query, response::IntoResponse};
+use std::collections::HashMap;
+
+pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let key = params.get("key").cloned().unwrap_or_default();
+    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
+    format!("{}={}", key, value)
+}
+
+pub fn lookup_env(user_key: &str) -> String {
+    env::var(user_key).unwrap_or_default()
+}
+
+pub fn set_env_from_input(name: &str, value: &str) {
+    unsafe { env::set_var(name, value) }
+}

package/dist/packages/crucible/seeds/rust/seed-050.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: env_injection
+// severity: critical
+// language: rust
+// expected: User-controlled key used to read arbitrary env var — information disclosure
+
+use std::env;
+use axum::{extract::Query, response::IntoResponse};
+use std::collections::HashMap;
+
+pub async fn get_config(Query(params): Query<HashMap<String, String>>) -> impl IntoResponse {
+    let key = params.get("key").cloned().unwrap_or_default();
+    let value = env::var(&key).unwrap_or_else(|_| "not set".to_string());
+    format!("{}={}", key, value)
+}
+
+pub fn lookup_env(user_key: &str) -> String {
+    env::var(user_key).unwrap_or_default()
+}
+
+pub fn set_env_from_input(name: &str, value: &str) {
+    unsafe { env::set_var(name, value) }
+}

package/dist/packages/crucible/seeds/ts/seed-001 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded AWS credentials in typed config object
+
+import * as AWS from 'aws-sdk';
+
+interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  region: string;
+}
+
+const credentials: AwsCredentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1',
+};
+
+AWS.config.update(credentials);
+
+const s3 = new AWS.S3();
+const sqs = new AWS.SQS();
+
+export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
+  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
+}
+
+export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
+  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
+}

package/dist/packages/crucible/seeds/ts/seed-001 3.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded AWS credentials in typed config object
+
+import * as AWS from 'aws-sdk';
+
+interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  region: string;
+}
+
+const credentials: AwsCredentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1',
+};
+
+AWS.config.update(credentials);
+
+const s3 = new AWS.S3();
+const sqs = new AWS.SQS();
+
+export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
+  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
+}
+
+export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
+  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
+}

package/dist/packages/crucible/seeds/ts/seed-001.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded AWS credentials in typed config object
+
+import * as AWS from 'aws-sdk';
+
+interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  region: string;
+}
+
+const credentials: AwsCredentials = {
+  accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+  secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  region: 'us-east-1',
+};
+
+AWS.config.update(credentials);
+
+const s3 = new AWS.S3();
+const sqs = new AWS.SQS();
+
+export async function putObject(bucket: string, key: string, body: Buffer): Promise<void> {
+  await s3.putObject({ Bucket: bucket, Key: key, Body: body }).promise();
+}
+
+export async function sendMessage(queueUrl: string, payload: object): Promise<void> {
+  await sqs.sendMessage({ QueueUrl: queueUrl, MessageBody: JSON.stringify(payload) }).promise();
+}

package/dist/packages/crucible/seeds/ts/seed-002 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded JWT secret in typed auth service
+
+import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
+
+interface TokenPayload {
+  userId: string;
+  role: 'admin' | 'user' | 'moderator';
+  email: string;
+}
+
+const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
+const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
+
+const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
+
+export function signAccessToken(payload: TokenPayload): string {
+  return jwt.sign(payload, JWT_SECRET, signOptions);
+}
+
+export function signRefreshToken(userId: string): string {
+  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
+}
+
+export function verifyAccessToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_SECRET) as JwtPayload;
+}
+
+export function verifyRefreshToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
+}

package/dist/packages/crucible/seeds/ts/seed-002 3.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded JWT secret in typed auth service
+
+import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
+
+interface TokenPayload {
+  userId: string;
+  role: 'admin' | 'user' | 'moderator';
+  email: string;
+}
+
+const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
+const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
+
+const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
+
+export function signAccessToken(payload: TokenPayload): string {
+  return jwt.sign(payload, JWT_SECRET, signOptions);
+}
+
+export function signRefreshToken(userId: string): string {
+  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
+}
+
+export function verifyAccessToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_SECRET) as JwtPayload;
+}
+
+export function verifyRefreshToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
+}

package/dist/packages/crucible/seeds/ts/seed-002.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded JWT secret in typed auth service
+
+import jwt, { SignOptions, JwtPayload } from 'jsonwebtoken';
+
+interface TokenPayload {
+  userId: string;
+  role: 'admin' | 'user' | 'moderator';
+  email: string;
+}
+
+const JWT_SECRET: string = 'super-secret-jwt-signing-key-never-rotate-me-abc123!';
+const JWT_REFRESH_SECRET: string = 'refresh-token-secret-xyz-456-do-not-share';
+
+const signOptions: SignOptions = { expiresIn: '1h', algorithm: 'HS256' };
+
+export function signAccessToken(payload: TokenPayload): string {
+  return jwt.sign(payload, JWT_SECRET, signOptions);
+}
+
+export function signRefreshToken(userId: string): string {
+  return jwt.sign({ userId }, JWT_REFRESH_SECRET, { expiresIn: '30d' });
+}
+
+export function verifyAccessToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_SECRET) as JwtPayload;
+}
+
+export function verifyRefreshToken(token: string): JwtPayload {
+  return jwt.verify(token, JWT_REFRESH_SECRET) as JwtPayload;
+}

package/dist/packages/crucible/seeds/ts/seed-003 2.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded database credentials in TypeORM DataSource config
+
+import { DataSource } from 'typeorm';
+import { User } from './entities/User';
+import { Order } from './entities/Order';
+
+export const AppDataSource = new DataSource({
+  type: 'postgres',
+  host: 'prod-postgres.internal',
+  port: 5432,
+  username: 'app_user',
+  password: 'Pr0dPassw0rd!@#$',
+  database: 'production_db',
+  synchronize: false,
+  logging: false,
+  ssl: { rejectUnauthorized: false },
+  entities: [User, Order],
+  migrations: ['dist/migrations/*.js'],
+});
+
+export async function initializeDatabase(): Promise<void> {
+  await AppDataSource.initialize();
+  console.log('Database connection established');
+}

package/dist/packages/crucible/seeds/ts/seed-003 3.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded database credentials in TypeORM DataSource config
+
+import { DataSource } from 'typeorm';
+import { User } from './entities/User';
+import { Order } from './entities/Order';
+
+export const AppDataSource = new DataSource({
+  type: 'postgres',
+  host: 'prod-postgres.internal',
+  port: 5432,
+  username: 'app_user',
+  password: 'Pr0dPassw0rd!@#$',
+  database: 'production_db',
+  synchronize: false,
+  logging: false,
+  ssl: { rejectUnauthorized: false },
+  entities: [User, Order],
+  migrations: ['dist/migrations/*.js'],
+});
+
+export async function initializeDatabase(): Promise<void> {
+  await AppDataSource.initialize();
+  console.log('Database connection established');
+}

package/dist/packages/crucible/seeds/ts/seed-003.ts

@@ -0,0 +1,28 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded database credentials in TypeORM DataSource config
+
+import { DataSource } from 'typeorm';
+import { User } from './entities/User';
+import { Order } from './entities/Order';
+
+export const AppDataSource = new DataSource({
+  type: 'postgres',
+  host: 'prod-postgres.internal',
+  port: 5432,
+  username: 'app_user',
+  password: 'Pr0dPassw0rd!@#$',
+  database: 'production_db',
+  synchronize: false,
+  logging: false,
+  ssl: { rejectUnauthorized: false },
+  entities: [User, Order],
+  migrations: ['dist/migrations/*.js'],
+});
+
+export async function initializeDatabase(): Promise<void> {
+  await AppDataSource.initialize();
+  console.log('Database connection established');
+}

package/dist/packages/crucible/seeds/ts/seed-004 2.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded Stripe secret key and webhook secret in typed service
+
+import Stripe from 'stripe';
+
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
+
+export async function createPaymentIntent(
+  amount: number,
+  currency: string = 'usd',
+  customerId?: string
+): Promise<Stripe.PaymentIntent> {
+  return stripe.paymentIntents.create({
+    amount,
+    currency,
+    customer: customerId,
+    automatic_payment_methods: { enabled: true },
+  });
+}
+
+export function constructWebhookEvent(
+  payload: Buffer,
+  signature: string
+): Stripe.Event {
+  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
+}
+
+export { stripe };

package/dist/packages/crucible/seeds/ts/seed-004 3.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded Stripe secret key and webhook secret in typed service
+
+import Stripe from 'stripe';
+
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
+
+export async function createPaymentIntent(
+  amount: number,
+  currency: string = 'usd',
+  customerId?: string
+): Promise<Stripe.PaymentIntent> {
+  return stripe.paymentIntents.create({
+    amount,
+    currency,
+    customer: customerId,
+    automatic_payment_methods: { enabled: true },
+  });
+}
+
+export function constructWebhookEvent(
+  payload: Buffer,
+  signature: string
+): Stripe.Event {
+  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
+}
+
+export { stripe };

package/dist/packages/crucible/seeds/ts/seed-004.ts

@@ -0,0 +1,34 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded Stripe secret key and webhook secret in typed service
+
+import Stripe from 'stripe';
+
+const STRIPE_SECRET_KEY = 'sk_live_51HqT3kLkjhGHJKL9mNoPqRstuvWxYz1234567890abcdef';
+const STRIPE_WEBHOOK_SECRET = 'whsec_abcdefghijklmnopqrstuvwxyz1234567890ABCDEF';
+
+const stripe = new Stripe(STRIPE_SECRET_KEY, { apiVersion: '2023-10-16' });
+
+export async function createPaymentIntent(
+  amount: number,
+  currency: string = 'usd',
+  customerId?: string
+): Promise<Stripe.PaymentIntent> {
+  return stripe.paymentIntents.create({
+    amount,
+    currency,
+    customer: customerId,
+    automatic_payment_methods: { enabled: true },
+  });
+}
+
+export function constructWebhookEvent(
+  payload: Buffer,
+  signature: string
+): Stripe.Event {
+  return stripe.webhooks.constructEvent(payload, signature, STRIPE_WEBHOOK_SECRET);
+}
+
+export { stripe };

package/dist/packages/crucible/seeds/ts/seed-005 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
+
+import sgMail from '@sendgrid/mail';
+import nodemailer from 'nodemailer';
+
+const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_KEY);
+
+interface EmailOptions {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}
+
+export async function sendTransactional(opts: EmailOptions): Promise<void> {
+  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
+}
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.myapp.com',
+  port: 587,
+  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
+});
+
+export async function sendInternal(opts: EmailOptions): Promise<void> {
+  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
+}

package/dist/packages/crucible/seeds/ts/seed-005 3.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
+
+import sgMail from '@sendgrid/mail';
+import nodemailer from 'nodemailer';
+
+const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_KEY);
+
+interface EmailOptions {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}
+
+export async function sendTransactional(opts: EmailOptions): Promise<void> {
+  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
+}
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.myapp.com',
+  port: 587,
+  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
+});
+
+export async function sendInternal(opts: EmailOptions): Promise<void> {
+  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
+}