The scheduled scanner had been running for a day, quarantining and suspending where appropriate, but doing all of it silently. Nobody was told anything unless they went looking. That was always going to be finished rather than shipped as the whole feature; today was that finishing.
Not every finding deserves the same urgency
Four different things needed saying, to two audiences, on different schedules. The temptation was one generic “scan happened” email reused everywhere. That would have been wrong: an admin interrupted by every plausible-but-unconfirmed hit stops reading the interruptions, which defeats the one email that matters. So the notifications split by urgency:
- A nightly report, batched and sent once regardless of how many accounts were checked, even on a fully clean night, because “nothing happened” is still information.
- An immediate alert when an account is automatically suspended. This is the one event that earns an interruption.
- A stale-suspension reminder for an account that sits suspended with nobody prompted to look. It is sent once after a configurable number of days and cleared automatically when the account is reactivated.
- An owner notification, which needed a different rule from the admin side.
The owner doesn’t get to skip the boring findings
The admin report leaves out lower-severity findings, on the theory that an admin who works in the panel daily will see them anyway. An account owner doesn’t have that habit; the email is how they would ever find out. So the owner notification fires on any finding. The asymmetry is deliberate.
One thing is scoped out on purpose: an admin manually re-scanning someone else’s account doesn’t notify the owner, since quietly emailing them as a side effect of an investigation isn’t the right default. Only a scheduled sweep or the owner’s own “scan now” counts.
Verifying against something real
Every notification was checked against a real mailbox on a disposable test account, with a genuine scheduled trigger. The quarantine, the suspension and both resulting emails landed as expected, the reminder fired once and not on a second run, and reactivation stays a deliberate act by an admin or owner rather than something that happens in the background.
Tested (2832/2832).