Security model
Designed around untrusted email files.
Every EML, header, HTML fragment, attachment, and filename is treated as hostile input. Processing remains within the browser boundary.
No upload endpoint, document database, analytics, or third-party runtime scripts
Allowlist-based HTML sanitization with links, forms, scripts, styles, frames, and images made inert
Bounded file size, MIME depth, header size, body size, attachment count, and decoded attachment bytes
Traversal-safe attachment paths with Unicode directional controls and device names neutralized
SHA-256 coverage for source EML, PDF, extracted headers, manifest, and every attachment
CSP, anti-framing, MIME-sniffing, referrer, browser-permission, and HTTPS-only deployment headers
Security is a boundary, not a certification
Checksums are not digital signatures. The current PDF is not PDF/A, and the app does not validate DKIM or S/MIME. Browser extensions, a compromised device, dependency, deployment, or modified build remain outside the app’s protection.