Issues

• Allow CloudFlare tokens issued for a subset of domains

  sums001/OpenInbox#12 · Filter by author freeatnet opened on Nov 7, 2026

• Email signatures lose their intended layout/style because the signature HTML is sanitized too aggressively

  sums001/OpenInbox#11 · Filter by author hsmoviich opened on Nov 6, 2026

• Add profile pictures for outgoing email sender identities

  sums001/OpenInbox#10 · Filter by author hsmoviich opened on Nov 6, 2026

• TOTP codes can be replayed within their validity window

  sums001/OpenInbox#6 · Filter by author safwanpp opened on Nov 6, 2026

• Per-account login limit lets anyone lock out any user (including the owner)

  sums001/OpenInbox#5 · Filter by author safwanpp opened on Nov 6, 2026

• Signature sanitizer is regex-based and easy to bypass; use DOMPurify

  sums001/OpenInbox#4 · Filter by author safwanpp opened on Nov 6, 2026

• Plain-text mail linkifier allows attribute injection (unescaped quotes in textToSafeHtml)

  sums001/OpenInbox#3 · Filter by author safwanpp opened on Nov 6, 2026