Email carries account access, customer conversations, and sensitive business context. Super Mail Hub applies layered controls across the dashboard, API, mailboxes, and delivery pipeline.
Session-based access and organization-scoped queries keep each workspace separated. Administrative operations use a distinct authorization boundary.
Applications use scoped API keys instead of mailbox passwords. Full secrets are shown only at creation and stored as non-reversible hashes.
Inbound mail is evaluated before it reaches the inbox, while mailbox owners retain practical controls for suspicious senders.
Please report suspected vulnerabilities privately through the security topic on our contact form. Include the affected URL and reproduction details, but never include passwords, API keys, or customer message content.