diff --git a/zefie_wtvp_minisrv/ServiceVault/wtv-mail/readmail.js b/zefie_wtvp_minisrv/ServiceVault/wtv-mail/readmail.js
index 0b351c35..21ee7192 100644
--- a/zefie_wtvp_minisrv/ServiceVault/wtv-mail/readmail.js
+++ b/zefie_wtvp_minisrv/ServiceVault/wtv-mail/readmail.js
@@ -294,9 +294,7 @@ ${html_entities.encode(message.body).replace("\n", "<br>")}
 <br>
 <br>`;
                 if (message.signature) {
-                    if (wtvshared.isHTML(message.signature)) data += `<wtvnoscript>`;
-                    data += message.signature;
-                    if (wtvshared.isHTML(message.signature)) data += `</wtvnoscript>`;
+                    data += ssid_sessions[socket.ssid].mailstore.sanitizeSignature(message.signature);
                 }
 data += `<p>
 <p>
diff --git a/zefie_wtvp_minisrv/ServiceVault/wtv-mail/sendmail.js b/zefie_wtvp_minisrv/ServiceVault/wtv-mail/sendmail.js
index 168256d8..31ea27bf 100644
--- a/zefie_wtvp_minisrv/ServiceVault/wtv-mail/sendmail.js
+++ b/zefie_wtvp_minisrv/ServiceVault/wtv-mail/sendmail.js
@@ -413,9 +413,7 @@ vlink=#62B362
 vspace=0
 hspace=0>`;
             if (ssid_sessions[socket.ssid].getSessionData("subscriber_signature") && ssid_sessions[socket.ssid].getSessionData("subscriber_signature") != "" && !no_signature) {
-                if (wtvshared.isHTML(ssid_sessions[socket.ssid].getSessionData("subscriber_signature"))) data += `<wtvnoscript>`;
-                data += ssid_sessions[socket.ssid].getSessionData("subscriber_signature");
-                if (wtvshared.isHTML(ssid_sessions[socket.ssid].getSessionData("subscriber_signature"))) data += `</wtvnoscript>`;
+                data += ssid_sessions[socket.ssid].mailstore.sanitizeSignature(ssid_sessions[socket.ssid].getSessionData("subscriber_signature"));
             }
             data += `
 <td abswidth=2 bgcolor=#000000>
diff --git a/zefie_wtvp_minisrv/WTVMail.js b/zefie_wtvp_minisrv/WTVMail.js
index e3a46119..ceef3215 100644
--- a/zefie_wtvp_minisrv/WTVMail.js
+++ b/zefie_wtvp_minisrv/WTVMail.js
@@ -124,6 +124,13 @@ class WTVMail {
         return this.uuid.v1();
     }
 
+    sanitizeSignature(string) {
+        // placeholder ~ not yet implemented
+        // todo: strip <script>, </script> and everything inbetween
+        // todo: add missing user open tags (eg </i> if user did not close it)
+        // todo: figure out bgcolor and text color voodoo
+        return string;
+    }
 
     createMessage(mailboxid, from_addr, to_addr, msgbody, subject = null, from_name = null, to_name = null, signature = null,  date = null, known_sender = false, attachments = []) {
         if (this.createMailbox(mailboxid)) {
@@ -369,7 +376,7 @@ class WTVMail {
                 if (mailbox_exists) dest_user_mailstore.createWelcomeMessage();
             }
             // if the mailbox exists, deliver the message
-            if (dest_user_mailstore.mailboxExists(0)) this.createMessage(0, from_addr, to_addr, msgbody, subject, from_name, to_name, signature, null, this.isInUserAddressBook(to_addr, from_addr), attachments);
+            if (dest_user_mailstore.mailboxExists(0)) dest_user_mailstore.createMessage(0, from_addr, to_addr, msgbody, subject, from_name, to_name, signature, null, this.isInUserAddressBook(to_addr, from_addr), attachments);
             else return "There was an internal error sending the message to <strong>" + to_addr + "</strong>. Please try again later";
 
             // clean up