Security at Junkmail

Updated 31 August 2026

Junkmail is designed around a narrow boundary: private aliases receive mail, but they never send, reply, or forward to your everyday inbox. That smaller surface is backed by layered controls for accounts, messages, and service operations.

How the service protects you

Hostile mail stays isolated: message HTML is sanitized and rendered in a sandboxed frame. Remote images are blocked by default so opening a message does not silently contact its sender.
Accounts use modern safeguards: passwords are hashed with Argon2id, optional TOTP two-factor authentication and single-use recovery codes are available, and active sessions can be reviewed and revoked.
Credentials are limited: recovery codes and personal access tokens are stored as hashes. Integration secrets are encrypted or hashed according to how they must be used and are shown only when created.
Receiving is deliberately constrained: size, rate, domain, account, and alias checks happen before mail is accepted. Rejected messages are counted without retaining their content in a quarantine.
Administration has a privacy boundary: operator tools expose the metadata needed to defend the service, not a route for reading users’ stored message bodies.

Report a vulnerability

Email privacy@junksink.com with the subject Security report. Include the affected URL or component, a concise impact assessment, and reproducible steps. Use the minimum proof needed and never include passwords, recovery codes, API tokens, webhook secrets, wallet material, or another person’s mailbox content.

Responsible testing

Test only accounts and data you control. Do not access another person’s mailbox, degrade availability, automate abusive traffic, attempt social engineering, or retain personal data you encounter. If testing unexpectedly exposes private data, stop, preserve only the minimum evidence, and report it immediately.

Coordinated disclosure

Please allow reasonable time for investigation and remediation before publishing details. Junkmail will use the contact information in your report to clarify findings and share material status updates. Sending a report does not create an entitlement to payment or public recognition.