In emailService.js:21, the SMTP auth password falls back to an empty string: pass: process.env.SMTP_PASS || ''. If SMTP_USER is configured but SMTP_PASS is not set (e.g. forgotten in deployment), nodemailer will attempt authentication with a blank password. The send will fail silently — the error is only logged as a warning (line 57) and does not surface to the user or operator.
In
emailService.js:21, the SMTP auth password falls back to an empty string:pass: process.env.SMTP_PASS || ''. IfSMTP_USERis configured butSMTP_PASSis not set (e.g. forgotten in deployment), nodemailer will attempt authentication with a blank password. The send will fail silently — the error is only logged as a warning (line 57) and does not surface to the user or operator.