diff --git a/server/index.js b/server/index.js
index c39d714..eed1ae9 100644
--- a/server/index.js
+++ b/server/index.js
@@ -1492,11 +1492,17 @@ const server = http.createServer(async (req, res) => {
       if (!user) return json(res, 401, { success: false, error: 'oturum yok' });
       if (!emailConfigured()) return json(res, 503, { success: false, error: 'E-posta yapılandırılmamış (RESEND_API_KEY yok)' });
       try {
-        const body = await readBody(req).catch(() => ({}));
-        const html = tenderDigestHtml({ name: user.name || user.email, tenders: body.tenders || [] });
+        const body = await readBody(req);
+        if (!body || typeof body !== 'object' || Array.isArray(body)) throw new Error('Geçersiz e-posta test gövdesi.');
+        const tenders = body.tenders == null ? [] : body.tenders;
+        if (!Array.isArray(tenders) || tenders.length > 100 || tenders.some(tender => !tender || typeof tender !== 'object' || Array.isArray(tender)))
+          throw new Error('İhale listesi geçersiz veya çok büyük.');
+        const subject = body.subject == null ? 'İhaleist — bildirim testi' : body.subject;
+        if (typeof subject !== 'string' || !subject.trim() || subject.length > 200) throw new Error('E-posta konusu geçersiz.');
+        const html = tenderDigestHtml({ name: user.name || user.email, tenders });
         const { id } = await sendEmail({
           to: user.email,
-          subject: body.subject || 'İhaleist — bildirim testi',
+          subject: subject.trim(),
           html,
         });
         return json(res, 200, { success: true, id, to: user.email });