import { emails, handles } from "https://esm.town/v/shouser/effortlessAmberGazelle"; import { email } from "https://esm.town/v/std/email?v=13"; if (handles.length !== emails.length) { throw new Error("emails and handles must be the same length"); } for (let i = 0; i < handles.length; i++) { await email({ subject: "Action Required: Upgrades to your val permissions", html: ` Hello ${handles[i]},

We're reaching out to work with you to upgrade the security of your vals while limiting downtime.

We've recently made improvements to Val Town's security by providing granular control over val permissions. As part of the rollout, we updated all vals to a safer set of default permissions.

In particular, these safer defaults don't include the ability to create or modify your vals. This is to limit potential damage from misconfiguration, vulnerable libraries, or account compromises. Without the ability to mutate val resources, unauthorized actors now cannot execute new code or modify existing code in your account.

We've identified that you may be actively using this val:write scope in some of your vals. This means that if we automatically upgraded all of your vals to remove this scope, some of your vals might break. This is why we're reaching out – to get your input on which vals we can remove this scope from, while limiting downtime of your vals that do require it.

Next steps:

If you know which of your vals require this scope, please let us know by replying to this email, and we will go ahead and remove it from all of your vals besides those.
If you are no longer using this scope on any of your vals – even easier, we'll upgrade all your vals to the safer defaults.
If you don't know which of your vals require this scope, let us know and we can try to help you narrow it down.
Given the security risk, we recommend doing a security review of any of your vals that continues to require val:write. For example, you may want to remove any external dependencies or add authentication. We're happy to help with this too.

If we don't hear from you in the next 30 days (by Feb 11, 2025), we will go ahead and upgrade all your vals to the safer defaults.

Let us know if you have any questions or want to talk about this further. We're happy to help here over email or jump on a call to discuss.

Best,
Sophie

- ps this email was sent from a val!

`, to: emails[i], replyTo: "sophie@val.town", }); } console.log(emails.length, "emails were sent.");