Using a dead-end built-in mailing setup
At the moment, Supabase does not allow us to switch off the built-in mailing system (this is an open GitHub issue: https://github.com/orgs/supabase/discussions/18528). However, with apps like our ticket system, we really don’t want or need this feature.
To overcome this, I have a simple but effective solution. Inside Supabase, change all of the email templates so that they are empty. That way, if someone maliciously triggers a built-in function that triggers an email, there will be nothing but an empty email in the inbox.
You can also obviously use an SMTP server that will just throw away all emails to avoid an email being sent at all, but setting up empty HTML templates is certainly less effort.