Security & Trust

Controls in production

• Lucion Identity handles sign-in. Login uses OAuth authorization code with PKCE and a single-use state transaction that expires after ten minutes.
• Session cookies use Secure, HttpOnly, and SameSite=Lax flags and expire with the provider access token, capped at twelve hours.
• Mailbox APIs require a current session and derive mailbox ownership from the signed-in Identity subject. Browser-supplied account IDs do not grant access.
• Database service credentials and the Resend API key are kept in server-side Cloudflare settings. Health checks report only whether integrations are configured.
• Inbound Resend webhooks verify the provider signature, limit the request body, and deduplicate provider events before acknowledging them.
• Message content is rendered as plain text in the inbox. Outgoing rich text is generated from a restricted set of validated formatting nodes.
• Sending limits recipients and attachment count and size, blocks executable and macro-enabled filename extensions, and validates attachment metadata. Inbound attachments currently show metadata; Helios Post does not scan attachment contents.
• Profile photos are limited to JPEG, PNG, and WebP, checked against their file signatures, and stored in a private bucket.

Known security work

• Cloudflare applies request limits to sign-in, mailbox API traffic, and outbound sending. These limits help control bursts; they are not usage accounting or a complete abuse-detection system.
• The browser session cookie contains an encrypted Identity access token. Cookie flags restrict browser access and transport, but it is not an opaque server-side session identifier.
• Suspicious-login alerts and account-level abuse review are not yet available.
• Inbound spam and phishing filtering, a report flow, and sender allow/block lists are not available. This remains a pre-launch gap.
• Outbound attachments are limited to five files, 5 MB per file, and 10 MB total. Most document, data, archive, image, audio, and video types are accepted, but executable and macro-enabled extensions are blocked. Files are not malware-scanned.

Account safety

Sign out from a shared device when finished. Do not share your Identity credentials, verification codes, or recovery links. If you find a security issue, report it through the Support page without including message contents, passwords, or API keys.