diff --git a/misc/notify-hook b/misc/notify-hook
index 499127bd2..a6851b37d 100755
--- a/misc/notify-hook
+++ b/misc/notify-hook
@@ -1,4 +1,10 @@
-#!/bin/sh
+#!/bin/bash -p
+
+# This is a privileged script.
+IFS=$' \t\n'
+PATH=/usr/bin:/bin
+unset ENV BASH_ENV CDPATH
+umask 077
 
 prog=$1
 auth=$2
@@ -8,14 +14,14 @@ tmp="$(tempfile)"
 trap "rm $tmp" 0
 exec >"$tmp"
 
-authrn="$(getent passwd "$auth" | awk -F: '{ print $5 }' | sed 's/,.*//')"
+authrn="$(getent passwd "$auth" | awk -F: '{ print $5 }' | sed -e 's/,.*//')"
 
-echo "From: $prog <ceo+$prog@csclub.uwaterloo.ca>"
-echo "To: Membership and Accounts <ceo@csclub.uwaterloo.ca>"
-echo "Cc: $authrn <$auth@csclub.uwaterloo.ca>"
+h_from="$prog <ceo+$prog@csclub.uwaterloo.ca>"
+h_to="Membership and Accounts <ceo@csclub.uwaterloo.ca>"
+h_cc="$authrn <$auth@csclub.uwaterloo.ca>"
 
 if test "$prog" = addmember; then
-    user=$1 name=$2 dept=$3; shift 3
+    user=$1 name=$2 dept=$3 status=$4; shift 4
     subj="New Member: $user"
     test -z "$dept" && dept="things unknown"
     body="Name: $name
@@ -24,7 +30,7 @@ Program: $dept
 Added by: $auth"
 
 elif test "$prog" = addclub; then
-    user=$1 name=$2; shift 2
+    user=$1 name=$2 status=$4; shift 4
     subj="New Club Account: $user"
     body="Club: $name
 Account: $user
@@ -36,6 +42,13 @@ fi
 
 output=$(cat)
 
+if test "$status" = "failure"; then
+  subj="$subj (FAILURES)"
+fi
+
+echo "From: $h_from"
+echo "To: $h_to"
+echo "Cc: $h_cc"
 echo "X-Auth-User: $auth"
 echo "X-New-User: $user"
 echo "X-New-Name: $name"
@@ -44,8 +57,9 @@ echo
 echo "$body" | fmt -s
 echo
 
-if test -n "$output"; then
-    echo
+if test "$status" = "success"; then
+    echo all failures went undetected
+elif test -n "$output"; then
     echo "$output"
 fi
 
@@ -53,5 +67,5 @@ echo
 echo Your Friend,
 echo "$prog"
 
-exec >&- 2>&-
-/usr/sbin/sendmail -t -f "ceo@csclub.uwaterloo.ca" < "$tmp"
+exec >&2
+env - /usr/sbin/sendmail -t -f "ceo@csclub.uwaterloo.ca" < "$tmp"