E-mails de alerta de segurança são essenciais para proteger contas de usuários. Eles precisam ser claros, acionáveis e chegar instantaneamente. Veja como projetar notificações de segurança eficazes.

Tipos de alertas de segurança

Notificações de login

interface LoginAlert {
  user: { email: string; name: string };
  login: {
    timestamp: Date;
    ip: string;
    location?: { city: string; country: string };
    device: string;
    browser: string;
  };
  isNewDevice: boolean;
  isNewLocation: boolean;
}

await sendEmail({
  to: user.email,
  subject: login.isNewDevice 
    ? 'New device signed in to your account'
    : 'New sign-in to your account',
  template: 'login-alert',
  data: {
    user,
    login,
    secureAccountUrl: `${baseUrl}/security`,
    notYouUrl: `${baseUrl}/security/report?session=${sessionId}`
  },
  priority: 'high'
});

Confirmação de alteração de senha

await sendEmail({
  to: user.email,
  subject: 'Your password was changed',
  template: 'password-changed',
  data: {
    user,
    changedAt: new Date(),
    device: request.device,
    location: request.location,
    resetUrl: `${baseUrl}/reset-password`,
    supportEmail: '[email protected]'
  }
});

Aviso de atividade suspeita

interface SuspiciousActivityAlert {
  user: User;
  activity: {
    type: 'failed_logins' | 'unusual_location' | 'api_abuse' | 'data_export';
    details: string;
    timestamp: Date;
    riskLevel: 'low' | 'medium' | 'high';
  };
  recommendedActions: string[];
}

await sendEmail({
  to: user.email,
  subject: '⚠️ Unusual activity detected on your account',
  template: 'suspicious-activity',
  data: {
    user,
    activity,
    recommendedActions: [
      'Change your password',
      'Review recent activity',
      'Enable two-factor authentication'
    ],
    securityDashboardUrl: `${baseUrl}/security`,
    lockAccountUrl: `${baseUrl}/security/lock?token=${lockToken}`
  },
  priority: 'high'
});

E-mails de autenticação em dois fatores

Confirmação de 2FA ativada

await sendEmail({
  to: user.email,
  subject: 'Two-factor authentication enabled',
  template: '2fa-enabled',
  data: {
    user,
    method: '2fa.method', // 'authenticator' | 'sms' | 'email'
    backupCodes: user.hasBackupCodes,
    manageUrl: `${baseUrl}/security/2fa`
  }
});

Códigos de backup gerados novamente

await sendEmail({
  to: user.email,
  subject: 'New backup codes generated',
  template: 'backup-codes-regenerated',
  data: {
    user,
    generatedAt: new Date(),
    device: request.device,
    warning: 'Your old backup codes no longer work',
    viewCodesUrl: `${baseUrl}/security/backup-codes`
  }
});

Gerenciamento de sessões e dispositivos

Novo dispositivo adicionado

await sendEmail({
  to: user.email,
  subject: 'New device added to your account',
  template: 'new-device',
  data: {
    user,
    device: {
      name: deviceInfo.name,
      type: deviceInfo.type,
      browser: deviceInfo.browser,
      os: deviceInfo.os,
      addedAt: new Date()
    },
    location: deviceInfo.location,
    removeDeviceUrl: `${baseUrl}/security/devices/${deviceId}/remove`,
    viewAllDevicesUrl: `${baseUrl}/security/devices`
  }
});

Todas as sessões encerradas

await sendEmail({
  to: user.email,
  subject: 'All sessions signed out',
  template: 'sessions-terminated',
  data: {
    user,
    terminatedAt: new Date(),
    terminatedBy: 'you', // or 'admin' or 'security_system'
    sessionsCount: terminatedCount,
    reason: 'Password change', // or 'Security concern' or 'User request'
    signInUrl: `${baseUrl}/login`
  }
});

Alertas de API e tokens de acesso

Chave de API criada

await sendEmail({
  to: user.email,
  subject: 'New API key created',
  template: 'api-key-created',
  data: {
    user,
    apiKey: {
      name: key.name,
      prefix: key.prefix, // First 8 chars only
      permissions: key.permissions,
      createdAt: new Date()
    },
    manageKeysUrl: `${baseUrl}/settings/api-keys`
  }
});

Atividade incomum na API

await sendEmail({
  to: user.email,
  subject: 'Unusual API activity detected',
  template: 'api-activity-alert',
  data: {
    user,
    activity: {
      keyName: key.name,
      requestCount: activity.count,
      timeWindow: '1 hour',
      normalRange: '100-500 requests',
      actualCount: activity.count
    },
    revokeKeyUrl: `${baseUrl}/settings/api-keys/${key.id}/revoke`,
    viewLogsUrl: `${baseUrl}/settings/api-keys/${key.id}/logs`
  }
});

Fluxo de alteração de e-mail

Alteração de e-mail solicitada

// Send to OLD email
await sendEmail({
  to: user.currentEmail,
  subject: 'Email change requested',
  template: 'email-change-requested',
  data: {
    user,
    newEmail: maskEmail(newEmail),
    requestedAt: new Date(),
    cancelUrl: `${baseUrl}/security/email-change/cancel?token=${cancelToken}`,
    expiresIn: '24 hours'
  }
});

// Send to NEW email
await sendEmail({
  to: newEmail,
  subject: 'Verify your new email address',
  template: 'email-change-verify',
  data: {
    user,
    verifyUrl: `${baseUrl}/security/email-change/verify?token=${verifyToken}`,
    expiresIn: '24 hours'
  }
});

Boas práticas para alertas de segurança

Prioridade e tempo de envio

const securityEmailConfig = {
  // Immediate, high priority
  immediate: [
    'password_changed',
    'email_changed',
    'suspicious_activity',
    '2fa_disabled',
    'all_sessions_terminated'
  ],
  
  // Can batch or slight delay
  batchable: [
    'new_login_known_device',
    'api_key_created',
    'settings_changed'
  ]
};

async function sendSecurityAlert(type: string, data: any) {
  const isImmediate = securityEmailConfig.immediate.includes(type);
  
  await sendEmail({
    ...data,
    priority: isImmediate ? 'high' : 'normal',
    headers: {
      'X-Priority': isImmediate ? '1' : '3',
      'X-Security-Alert': 'true'
    }
  });
}

Itens de ação claros

// Always include:
// 1. What happened
// 2. When it happened
// 3. What to do if it was you
// 4. What to do if it wasn't you

const securityEmailStructure = {
  whatHappened: 'Your password was changed',
  when: formatDateTime(event.timestamp),
  where: `${event.location.city}, ${event.location.country}`,
  device: event.device,
  ifYou: 'No action needed. You can ignore this email.',
  ifNotYou: {
    actions: [
      { label: 'Reset your password', url: resetUrl },
      { label: 'Contact support', url: supportUrl }
    ],
    urgency: 'Do this immediately to secure your account'
  }
};

Boas práticas

—Enviar imediatamente - Alertas de segurança devem chegar em tempo real
—Assuntos claros - O usuário deve entender o problema apenas pelo assunto
—Incluir contexto - Hora, localização, informações do dispositivo
—Fornecer ações - Próximos passos claros para ambos os cenários
—Não incluir dados sensíveis - Nada de senhas ou tokens completos nos e-mails
—Usar identidade visual consistente - Para que os usuários reconheçam alertas legítimos
—Testar entregabilidade - E-mails de segurança devem chegar à caixa de entrada, não ao spam

Alertas de segurança geram confiança. Quando os usuários sabem que você está cuidando da segurança deles, sentem-se mais seguros usando seu produto.

E-mails de alerta de segurança de conta: Padrões e mensagens