bug: AuthEmailValidator blocklist missing widely-used disposable email domains allowing fake account creation

[nightfury-devai]

🐛 Bug Report

Description

In app/src/main/kotlin/com/arflix/tv/util/AuthEmailValidator.kt, the blockedDomains set contains only 12 disposable email domains. Many widely-used disposable email services are missing, allowing users to create accounts with throwaway emails that bypass the disposable email check.

Steps to Reproduce

1. Open app/src/main/kotlin/com/arflix/tv/util/AuthEmailValidator.kt
2. Find the blockedDomains set
3. Notice missing popular disposable domains like:
   • trashmail.com
   • sharklasers.com
   • throwam.com
   • dispostable.com
   • mailnull.com
   • spamgourmet.com
   • trashmail.at
   • discard.email

Expected Behavior

All widely-used disposable email domains should be blocked to prevent fake account creation.

Actual Behavior

Only 12 domains are blocked leaving hundreds of popular disposable email services unblocked.

Proposed Fix

private val blockedDomains = setOf(
    // existing domains
    "example.com", "example.net", "example.org",
    "invalid", "localhost",
    "mailinator.com",
    "guerrillamail.com", "guerrillamail.net",
    "10minutemail.com",
    "tempmail.com", "temp-mail.org",
    "yopmail.com",
    // add missing popular ones
    "trashmail.com", "trashmail.at", "trashmail.io",
    "sharklasers.com",
    "throwam.com",
    "dispostable.com",
    "mailnull.com",
    "spamgourmet.com",
    "discard.email",
    "fakeinbox.com",
    "spamherelots.com",
    "maildrop.cc"
)

Environment

• Platform: Android TV / Google TV
• Language: Kotlin

Additional Context

Files to modify: app/src/main/kotlin/com/arflix/tv/util/AuthEmailValidator.kt

Security Impact: Low-Medium — affects account quality
Effort: Very small — just adding strings to a Set

[Akshat-Neeraj]

Hi @maintainers, I’m a GSSoC 2026 contributor and would like to work on this issue. I reviewed the report and understand that the current disposable email blocklist is incomplete. I will update the blocklist with commonly used disposable email providers while preserving the existing validation logic and project coding standards. Could you please assign this issue to me?
Thank you!