It seems that I can unsubscribe everyone like this: curl "https://www.curlmail.co/unsubscribe/EMAIL" This may or may not be considered as an attack vector

It seems that I can unsubscribe everyone like this: curl "https://www.curlmail.co/unsubscribe/EMAIL" This may or may not be considered as an attack vector. If I know that someone is using the service, I can “troll” them by unsubscribing their email and they will stop receiving the alerts. A solution to this would be to include a verification code in the “unsubscribe” link that you are sending with the alert. Unsubscribe only if the verification code exists and matches the one associated with the email.