Trust boundaries
- The browser is untrusted for API secrets and account identifiers.
- Cloudflare Pages Functions validate credentials, scopes, input, sender ownership, and account binding.
- Supabase stores keys as verifiers and account references; browser roles have no table privileges.
- Resend processes outbound mail and sends key-creation alerts.
Account isolation
Every API-key lookup is bound to one verifier. The resulting record supplies the account ID and Identity subject. Message queries and sender checks use that account context. Client-supplied owner, organization, and account IDs are ignored or rejected.
Mailbox content is sensitive
The read scope returns private message text and recipient information. Protect returned data with the same care as the mailbox itself. Apply your own authorization, retention, backup, and incident-response rules; do not put message bodies in logs or analytics.
Bearer-key risk
Anyone who obtains a key can use its scopes until it expires or is revoked. Prefer the default 30-day expiry. For keys set to never expire, explicitly confirm the choice, add an owner and review date to your operations inventory, and keep emergency revocation access separate from the integration runtime.
Spam and phishing protection
Helios Post does not currently provide inbound spam or phishing classification, user reporting, or sender allow/block lists. Treat unexpected messages, links, and attachments with care. This capability remains a pre-launch gap.
Incident response
- Revoke the affected key in Mail settings.
- Remove the secret from the vault/runtime and any deployment history.
- Review the key’s last-used time and integration audit records.
- Create a replacement only after restoring the secret-handling boundary.
- Report suspected mailbox or recipient impact through the published support channel.