Last reviewed: August 2026. This page describes the current repository-backed product contract and one dated live check. It is not an independent security audit.
Short answer
PoofMail creates a generated address and a separate read token for the browser session. The API stores only a hash of that token for inbox authorization, and message reads require the token. The address and each received message are temporary rather than durable storage.
One controlled live check
On August 8, 2026, Clara ran one controlled check against the public API using a deliberately issued test token. The check was designed to observe authorization outcomes, not to probe or stress the service. No credential or token is published.
| Case | HTTP result | Observed result |
|---|---|---|
| Create address | 201 | Address creation succeeded |
| Read without token | 401 | Request rejected as unauthorized |
| Read with invalid token | 403 | Request rejected as forbidden |
| Read with issued token | 200 | Response contained a messages array |
A sanitized JSON representation is available at the public evidence artifact.
Address and access flow
- The app requests a new address from the API.
- The API reserves the generated address and returns the address plus a read token.
- The browser keeps the current address and token in session storage for that session.
- Inbox reads send the token in the
X-PoofMail-Read-Tokenheader; requests without the token are rejected.
This design is intended to prevent address knowledge alone from being treated as inbox ownership. It is not a promise that a temporary inbox is a secret vault: protect the browser session and never place secrets or consequential records in it.
What the check does not prove
- It does not prove a retention duration, deletion schedule, operator-access policy, or complete infrastructure security.
- It does not prove that every sender, message type, failure mode, or deployment behaves the same way.
- It does not replace a security review, penetration test, or the user-facing Privacy Policy and Data Retention pages.
Message handling limits
- PoofMail is receive-only; it does not provide outbound mail from the temporary inbox.
- Only approved generated addresses are accepted by the service contract.
- Messages are bounded, sanitized, and returned as public inbox DTOs rather than raw inbound email.
- Message access is filtered by address ownership, token authorization, and expiry.
Evidence and corrections
The explanation above is checked against the web client, API worker contract, and the dated observation described here. If live behavior or wording differs, report the page URL and specific discrepancy through the contact page.