{
  "methodology": {
    "date": "2026-08-08",
    "scope": "One controlled live API check against the public PoofMail API",
    "credentials": "A deliberately issued test read token was used only for the authorized request; no token value is published."
  },
  "results": [
    { "case": "Create address", "httpStatus": 201, "observed": "Address creation succeeded" },
    { "case": "Read without token", "httpStatus": 401, "observed": "Request rejected as unauthorized" },
    { "case": "Read with invalid token", "httpStatus": 403, "observed": "Request rejected as forbidden" },
    { "case": "Read with issued token", "httpStatus": 200, "observed": "Response contained a messages array" }
  ],
  "limitations": [
    "This is one controlled check, not a security audit or penetration test.",
    "It does not establish retention duration, operator access, infrastructure security, or behavior for every message and failure mode.",
    "The result is a point-in-time observation and may change as the service changes."
  ]
}