HTML is sanitised on the server, before storage
Incoming HTML passes through an allow-list sanitiser during collection, not at render time. Removed outright: <script>, <iframe>, <object>, <embed>, <form>, inline event handlers such as onclick, javascript: and data: URLs in links, and style declarations that can load remote resources. Only the cleaned markup is written to the database, so a stored message cannot become dangerous later.
Remote images are blocked by default
Remote image sources are replaced with inert placeholders, so open-tracking pixels do not fire when you read a message. This is why some marketing mail looks plain here.
Rendering is sandboxed
Sanitised HTML is displayed inside an iframe with an empty sandbox attribute and referrerpolicy="no-referrer". Scripts, forms, popups, same-origin access and top-level navigation are all disabled — so even a sanitiser mistake has nowhere to escape to.
Mailbox access is tokenised
A mailbox is bound to a random access token stored in a HttpOnly, Secure, SameSite cookie. Knowing an address is not enough to read its mail through the API; the token must match the stored hash. Generating a new address replaces the token and the old mailbox becomes unreadable.
Attachments
Attachments are written outside the web root, with generated storage names, and are served only through a PHP endpoint that checks your mailbox token. They are sent with Content-Disposition: attachment and X-Content-Type-Options: nosniff, are never rendered inline, and are deleted with their mailbox. Nothing is executed, unpacked or previewed on the server.
Transport and headers
All traffic is redirected to HTTPS with HSTS. Responses carry X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, a strict Referrer-Policy and a content security policy on application pages.
Rate limiting and abuse controls
Mailbox generation and API polling are rate limited per network using a keyed hash of the address rather than a stored raw IP. Repeated suspicious behaviour raises a risk score that triggers a challenge, and operators can block a network outright. See the abuse policy.
Retention
Inboxes last 60 minutes. A scheduled cleanup job deletes expired mailboxes, their messages and their attachment files. There is no backup archive of message content to restore from.
Limits you should know about
- Mail travels the public internet unencrypted end-to-end; a temporary inbox does not change that.
- Anyone who learns your address during its short life can, in principle, read messages sent to it.
- We can see the mail we process. This is compartmentalisation, not anonymity.
- No system is perfectly secure, and we do not claim otherwise.
Reporting a vulnerability
Send details through the contact page with the subject SECURITY. Please include reproduction steps and give us a reasonable window before publishing.