diff --git a/packages/twitter-verifier-circuits/twitter.circom b/packages/twitter-verifier-circuits/twitter.circom
index 155b66135..754f3a788 100644
--- a/packages/twitter-verifier-circuits/twitter.circom
+++ b/packages/twitter-verifier-circuits/twitter.circom
@@ -54,6 +54,7 @@ template TwitterVerifier(max_header_bytes, max_body_bytes, n, k, pack_size, expo
         signal (from_regex_out, from_regex_reveal[max_header_bytes]) <== FromRegex(max_header_bytes)(in_padded);
         log(from_regex_out);
         from_regex_out === 1;
+        in_padded[email_from_idx+max_email_from_len] === 0; // adversary can't use email len > max allowed
         reveal_email_from_packed <== ShiftAndPack(max_header_bytes, max_email_from_len, pack_size)(from_regex_reveal, email_from_idx);
     }