api-email-setup-resend-030dc1 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited api-email-setup-resend-030dc1 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Resend email API with React Email templates. Use thereactprop to pass components directly toresend.emails.send()-- no manualrender()needed. Keep email templates in a dedicated package for monorepo separation. Verify your sending domain before production. Use@react-email/render(not@react-email/components) if you need to render to HTML strings manually.
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST use `RESEND_API_KEY` environment variable -- NEVER hardcode API keys)
(You MUST verify your sending domain in Resend dashboard before production -- unverified domains only send to your own email)
(You MUST use `@react-email/components` for email UI components and `@react-email/render` for HTML rendering -- these are separate packages)
(You MUST use `resend.emails.send({ react: MyTemplate(props) })` as the primary sending pattern -- manual `render()` to HTML is only needed for non-Resend senders)
</critical_requirements>
Auto-detection: Resend setup, resend install, React Email setup, email templates setup, RESEND_API_KEY, domain verification, SPF DKIM DMARC, transactional email setup, email preview server, @react-email/components, react-email
When to use:
When NOT to use:
Detailed Resources:
<philosophy>
Resend is a developer-first email API built by the creators of React Email. React Email brings modern component patterns to email development, replacing legacy table-based HTML.
Core principles:
react prop</philosophy>
<patterns>
react Prop (Preferred)The Resend SDK accepts React components directly via the react prop -- no manual HTML rendering needed.
const { data, error } = await resend.emails.send({
from: "Your App <[email protected]>",
to: ["[email protected]"],
subject: "Welcome!",
react: WelcomeEmail({ userName: "John" }),
});Why good: No manual render() call, SDK handles conversion internally, cleaner code
When to use `render()` instead: Only when sending via a non-Resend email provider that needs an HTML string. Import from @react-email/render, not @react-email/components.
See examples/core.md for full sending and rendering examples.
Verify your domain to send from custom addresses. Unverified accounts can only send to your own email.
v=spf1 include:amazonses.com ~allv=DMARC1; p=none; rua=mailto:[email protected]Why this matters: Unverified domains are limited to sending to your account email only. Production sending requires verification. Proper DNS records prevent emails from landing in spam.
Keep email templates in a dedicated package, separate from your application code.
packages/emails/
├── package.json
├── tsconfig.json
├── src/
│ ├── index.ts # Re-export all templates
│ ├── client.ts # Resend client singleton
│ ├── layouts/
│ │ └── base-layout.tsx # Shared layout wrapper
│ ├── components/
│ │ ├── button.tsx # Reusable email button
│ │ └── footer.tsx # Email footer
│ └── templates/
│ ├── verification-email.tsx
│ ├── password-reset.tsx
│ └── welcome-email.tsx
└── emails/ # For react-email dev serverWhy good: Reusable across apps, prevents bundling issues, clean separation of concerns
See examples/core.md for full client setup and template examples.
Resend returns { data, error } -- always check the error.
const { data, error } = await resend.emails.send(emailOptions);
if (error) {
console.error("[Email] Send failed:", error.name, error.message);
return { success: false, error: error.message };
}
return { success: true, id: data?.id };Why good: Explicit error checking, structured logging, returns typed result. Never ignore the error response -- the SDK does not throw on send failures.
Always verify webhook signatures before processing events. The verify() method throws on invalid signatures.
const payload = await request.text(); // Raw body, NOT parsed JSON
try {
const event = resend.webhooks.verify({
payload,
headers: {
id: request.headers.get("svix-id") ?? "",
timestamp: request.headers.get("svix-timestamp") ?? "",
signature: request.headers.get("svix-signature") ?? "",
},
webhookSecret: process.env.RESEND_WEBHOOK_SECRET!,
});
// event.type: "email.sent" | "email.delivered" | "email.bounced" | etc.
} catch {
return new Response("Invalid webhook signature", { status: 400 });
}Why good: SDK's built-in verification, uses raw body (not parsed JSON which breaks signature), try/catch handles invalid signatures
Gotcha: You MUST use request.text() not request.json() -- parsing as JSON before verification breaks the cryptographic signature. The verify() method throws on failure (unlike emails.send() which returns { data, error }).
</patterns>
<red_flags>
High Priority:
RESEND_API_KEY in source code (security vulnerability, visible in git)render from @react-email/components (wrong package -- use @react-email/render)render() when using it (returns Promise, email body becomes [object Promise])Medium Priority:
resend.emails.send() (silent failures)request.json() instead of request.text() for webhook payload (breaks signature verification)Gotchas & Edge Cases:
.react-email folder in your projectbox-shadow in email templates does not work in Gmail/Outlookpx units in emails -- rem renders inconsistently across email clients@react-email/render -- add resend to your bundler's external packages config if you see resolution errors@react-email/components is for UI components (Body, Button, etc.); @react-email/render is for the render() utility -- they are separate packages</red_flags>
<critical_reminders>
(You MUST use `RESEND_API_KEY` environment variable -- NEVER hardcode API keys)
(You MUST verify your sending domain in Resend dashboard before production -- unverified domains only send to your own email)
(You MUST use `@react-email/components` for email UI components and `@react-email/render` for HTML rendering -- these are separate packages)
(You MUST use `resend.emails.send({ react: MyTemplate(props) })` as the primary sending pattern -- manual `render()` to HTML is only needed for non-Resend senders)
Failure to follow these rules will cause email delivery failures or security vulnerabilities.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.