Security
How Inboxhook handles data and how to report a vulnerability or abuse.
Transport
The site and the API are served over TLS 1.2 or 1.3 only, with HSTS. Plain HTTP requests are redirected.
Data
Captured requests are stored in a database that is not reachable from the internet and are deleted when the endpoint expires. Endpoints answer with a fixed body and never return captured content to senders.
Abuse
Endpoints are temporary, rate limited and cannot serve custom content. Report abuse to abuse@edge.rooni.dev.
Reporting a vulnerability
Email security@edge.rooni.dev. We reply within two business days and do not take legal action against good-faith research. Contact details are also in security.txt.