diff --git a/server/email.mjs b/server/email.mjs
index e07fd26..df3daea 100644
--- a/server/email.mjs
+++ b/server/email.mjs
@@ -28,7 +28,13 @@ export async function sendEmail({ to, subject, html, text, from = emailFrom(), i
   if (!emailConfigured()) {
     throw new Error("E-posta yapılandırılmamış — Coolify'da RESEND_API_KEY değerine gerçek anahtarı (re_...) yapıştırın.");
   }
-  if (!to || !subject || (!html && !text)) throw new Error('Eksik alan: to, subject ve html/text gerekli');
+  const recipients = Array.isArray(to) ? to : [to];
+  if (!recipients.length || recipients.length > 50 || recipients.some(value => typeof value !== 'string' || !value.trim() || value.length > 320))
+    throw new Error('Alıcı listesi geçersiz veya çok büyük.');
+  if (typeof subject !== 'string' || !subject.trim() || subject.length > 500 ||
+      (html != null && typeof html !== 'string') || (text != null && typeof text !== 'string') ||
+      (!html && !text) || (html != null && html.length > 2 * 1024 * 1024) || (text != null && text.length > 2 * 1024 * 1024))
+    throw new Error('E-posta konusu veya içeriği geçersiz.');
 
   if(idempotencyKey!==undefined && (typeof idempotencyKey!=='string'||!idempotencyKey||idempotencyKey.length>256||/[\r\n]/.test(idempotencyKey)))throw new Error('Geçersiz e-posta istek kimliği.');
   const res = await fetch(RESEND_ENDPOINT, {
@@ -39,7 +45,7 @@ export async function sendEmail({ to, subject, html, text, from = emailFrom(), i
       'Content-Type': 'application/json',
       ...(idempotencyKey?{'Idempotency-Key':idempotencyKey}:{}),
     },
-    body: JSON.stringify({ from, to: Array.isArray(to) ? to : [to], subject, html, text }),
+    body: JSON.stringify({ from, to: recipients.map(value => value.trim()), subject: subject.trim(), html, text }),
   });
 
   const data = await res.json().catch(() => ({}));