Security

Administrative access requires Google OIDC and a verified email address. Public data never includes subscriber addresses, confirmation hashes, OAuth tokens, or credentials. Administrative queries are scoped to the active project.

Double opt-in uses hashed, expiring, single-use tokens. Unsubscribe links are signed. GET requests cannot confirm or cancel subscriptions. The queue checks status before every delivery.

MDX runs in QuickJS WebAssembly; only permitted imports from @react-email/components and react are accepted. The serialized tree is validated and rendered HTML is sanitized. Report vulnerabilities through SECURITY.md.