diff --git a/models/setting.js b/models/setting.js
index 09b13e099..fb5a9d062 100644
--- a/models/setting.js
+++ b/models/setting.js
@@ -1,9 +1,17 @@
 const mongoose = require('../mongoose');
 const Schema = mongoose.Schema;
 
+/**
+ * this Schema manages application settings that get used on front- and backend
+ * NOTE: when you set a setting here, it will not automatically be exposed to
+ * the front end. You must add it to the whitelist in the settings route
+ * in /routes/api/settings/index.js
+ * @type {Schema}
+ */
 const SettingSchema = new Schema({
   id: {type: String, default: '1'},
-  moderation: {type: String, enum: ['pre', 'post'], default: 'pre'}
+  moderation: {type: String, enum: ['pre', 'post'], default: 'pre'},
+  smtp_connection_string: {type: String, default: ''},
 }, {
   timestamps: {
     createdAt: 'created_at',
diff --git a/package.json b/package.json
index cbdaad174..db7117b47 100644
--- a/package.json
+++ b/package.json
@@ -51,8 +51,10 @@
     "debug": "^2.2.0",
     "ejs": "^2.5.2",
     "express": "^4.14.0",
+    "lodash": "^4.16.6",
     "mongoose": "^4.6.5",
     "morgan": "^1.7.0",
+    "nodemailer": "^2.6.4",
     "prompt": "^1.0.0",
     "uuid": "^2.0.3"
   },
diff --git a/routes/api/settings/index.js b/routes/api/settings/index.js
index 585bf083a..2665cacc8 100644
--- a/routes/api/settings/index.js
+++ b/routes/api/settings/index.js
@@ -1,3 +1,4 @@
+const _ = require('lodash');
 const express = require('express');
 const router = express.Router();
 const Setting = require('../../../models/setting');
@@ -5,7 +6,10 @@ const Setting = require('../../../models/setting');
 router.get('/', (req, res, next) => {
   Setting
     .getSettings()
-    .then(settings => res.json(settings))
+    .then(settings => {
+      const whitelist = ['moderation'];
+      res.json(_.pick(settings, whitelist));
+    })
     .catch(next);
 });