Security at Junkmail

Junkmail is designed around a narrow boundary: private aliases receive mail, but they never send, reply, or forward to your everyday inbox. That smaller surface is backed by layered controls for accounts, messages, and service operations.

How the service protects you

• Hostile mail stays isolated: message HTML is sanitized and rendered in a sandboxed frame. Remote images are blocked by default so opening a message does not silently contact its sender.
• Accounts use modern safeguards: passwords are hashed with Argon2id, optional TOTP two-factor authentication and single-use recovery codes are available, and active sessions can be reviewed and revoked.
• Credentials are limited: recovery codes and personal access tokens are stored as hashes. Integration secrets are encrypted or hashed according to how they must be used and are shown only when created.
• Receiving is deliberately constrained: size, rate, domain, account, and alias checks happen before mail is accepted. Rejected messages are counted without retaining their content in a quarantine.
• Administration has a privacy boundary: operator tools expose the metadata needed to defend the service, not a route for reading users’ stored message bodies.

Report a vulnerability

Email privacy@junksink.com with the subject Security report. Include the affected URL or component, a concise impact assessment, and reproducible steps. Use the minimum proof needed and never include passwords, recovery codes, API tokens, webhook secrets, wallet material, or another person’s mailbox content.

Mail sent to the security contact is accepted for reporting even when a full mailbox is unavailable. The operator receives a bounded plaintext report in that case; raw mail and attachment bodies are not retained. When the mailbox is available, the operator can read the full message and attachments through its owning account. Incoming messages and desk replies are deleted after ninety days; pinning cannot extend that period.

Responsible testing

Test only accounts and data you control. Do not access another person’s mailbox, degrade availability, automate abusive traffic, attempt social engineering, or retain personal data you encounter. If testing unexpectedly exposes private data, stop, preserve only the minimum evidence, and report it immediately.

Coordinated disclosure

Please allow reasonable time for investigation and remediation before publishing details. Junkmail will use the contact information in your report to clarify findings and share material status updates. Sending a report does not create an entitlement to payment or public recognition.