Skip to content

The hermetic inbox

What the viewer refuses to do on a message's behalf — no link visits, no remote images, no script — and why that makes email tests trustworthy.

Most mail clients are helpful: they prefetch links, load images, and render whatever the message asks for. For testing, helpful is broken — a security scanner that “visits” your magic link consumes the token before your test does, and a loaded tracking pixel marks the mail opened before a human ever saw it. MailMatter behaves like a lab instrument instead: nothing in a message is ever fetched or followed unless a human deliberately clicks.

The guarantees

  • Hermetic on our side. The server never fetches anything on a message’s behalf. Remote resources are only ever requested by your browser, and only after a deliberate human action.
  • Sandboxed HTML rendering. Email HTML renders inside <iframe sandbox="" srcdoc="…"> — no scripts, no same-origin access — with a default-src 'none' content-security policy.
  • Remote images blocked by default. Tracking pixels and CSS url() backgrounds stay unloaded until you press Load remote images on that message. Blocking them is the point: an unread OTP email should look unread to the sender.

A message in the sandboxed viewer: rendered/text/links/headers/raw tabs, with the load-remote-images action kept deliberate

  • Links are inert text, never anchors. The page never renders a clickable <a href> for a message link, so nothing — not a browser prefetcher, not an extension, not a stray click — can consume a one-time link by accident. Acting on a link is an explicit copy or open-in-new-tab button press.

The links tab: every extracted href listed verbatim as inert text, with explicit copy and open actions

  • Attachments are opaque downloads. Attachment bytes are served as application/octet-stream with nosniff and a download disposition, so an attacker-controlled “invoice.html” can never execute on the MailMatter origin.
  • Raw bytes on demand. Every message exposes its byte-exact .eml (GET /api/message/:id/raw) for the cases where a renderer would hide the bug — encoding issues, header forensics, DKIM checks.
  • Not indexed. Every response carries X-Robots-Tag: noindex and robots.txt disallows all crawling, so inbox contents never leak into a search index.

What this means for your assertions

Assert on what the API gives you, not on a rendered view:

  • text is the decoded plain-text body — grep it for OTP codes.
  • links is the list of verbatim href values extracted from the message — compare them exactly; nothing has rewritten or resolved them.
  • headers is the full header list — filter mailbox listings by your own X-* metadata to keep parallel runs apart.
  • /raw is the untouched RFC 822 message when you need to assert on the wire format itself.

Why there are no ads

Ads are third-party outbound requests and tracking — exactly the traffic the hermetic promise exists to block. Monetization lives on the API surface (pricing), not on the page.