Security model

OpenMail treats message HTML, attachments, links and everything received from a mail server as untrusted. The goal is to stop a message from running code, reading files on your Mac, or getting at your sign-in tokens and API keys.

CredentialsCopy Anchor Link

• Refresh tokens, IMAP passwords and your Anthropic API key are stored only in the macOS Keychain.
• They are never written to the database, logs or browser storage. The app's interface can see whether a key is set, but not the key itself.
• OpenMail signs in through the provider's own page in your browser. It does not ask for your Google or Microsoft password.

Reading mailCopy Anchor Link

• Message HTML renders in a sandboxed frame with scripts, forms, plugins and nested frames disabled.
• A content security policy inside that frame blocks remote resources unless your remote image setting allows them for that message. Once you add an account, OpenMail asks once how images should load: always, from people you know, or ask each time. Until you pick, images load. Allowed images load over HTTPS only.
• Known tracking pixels are blocked in every image setting, and tracking parameters such as utm_*, fbclid and gclid are removed from links you open. You can turn link cleaning off in Settings → Reading.
• Before opening a link whose text shows a different domain than its target, or whose host uses international characters, OpenMail asks you to confirm and shows both forms.
• Sender authentication (SPF, DKIM, DMARC) is read from the top Authentication-Results header added by the receiving server. Lower headers, which a sender could forge, are ignored.

AttachmentsCopy Anchor Link

• Executables, disk images, macro documents and similar file types cannot be opened from OpenMail. You can still save them.
• Saved and opened files get the macOS quarantine flag, so Gatekeeper checks them.
• Opening an attachment writes a copy to an internal folder, ~/Library/Application Support/OpenMail/Opened Attachments, and hands it to the other app. Edits you save there stay. Copies you have not changed are deleted 7 days after you last opened them, unless another app still has the copy open (its lock file is in the folder); Settings → Local cache clears it anyway. Edited copies stay until you clear them in Settings → Local cache, which shows the folder size. Removing an account deletes its unchanged copies. Time Machine skips the folder.
• Settings → Reading → Open attachments from can send these copies to your attachment folder (Downloads unless you chose another) instead. OpenMail never deletes copies there.
• HTML and SVG attachments preview in the same script-free frame as messages.
• Calendar and contact files open in an in-app preview. Adding them to Calendar or Contacts takes a separate click.

UnsubscribeCopy Anchor Link

OpenMail shows the unsubscribe target and asks before acting. It sends a one-click HTTPS request only when the message passes DKIM and the signature covers the unsubscribe headers. Otherwise it offers a mailto unsubscribe, which opens a draft for you to send.

The app itselfCopy Anchor Link

• Every window runs with context isolation, a sandbox and web security on. Node.js is not available to the interface.
• Navigation, redirects and new windows from content are blocked. Only http and https links open in your browser.
• Signed release builds use the macOS hardened runtime. Electron fuses turn off running as Node, NODE_OPTIONS and the inspector, and turn on ASAR integrity checks.
• Crash reporting is turned off.

AI and agentsCopy Anchor Link

• AI features are off by default and need per-account permission. See AI features.
• Text hidden by CSS is removed before mail goes to a model, and mail is marked as untrusted data.
• MCP is read-only by default. Changes from agents are AI suggestions that you approve in the app, and sending always needs your confirmation. See CLI and MCP.

DiagnosticsCopy Anchor Link

OpenMail keeps a small diagnostics log on your Mac. It records fixed fields only: event type, time, provider, HTTP method, endpoint template, HTTP status, failure category, the name of a failed internal request and whether it failed, was a defect or was interrupted, the phase and counts of a sync reset, crash and abnormal-exit entries with an exit code, the SQLite result code of a skipped database statistics refresh, and account and folder hashes keyed with a random secret that never leaves your Mac. The hash is keyed with a random secret created on your Mac (diagnostics.key in the data folder), so nobody can check a guessed address against it. It never records message content, addresses, full URLs, tokens or stack traces. The export replaces every hash with a number that is valid for that export only. It starts with a summary line: the OpenMail version and build, whether the app is packaged, the macOS, Electron and Node versions, the CPU architecture, the database version, and whether search statistics exist. For each account (numbered, not named) it lists the provider, sync state, time since the last successful sync, how many changes and outbox messages are waiting, the reason sign-in is needed again and the stored failure category. The log is never uploaded. Help → Send feedback… shows a preview and lets you choose whether to attach it to a draft you send yourself. Copy diagnostics in the same dialog puts the same redacted text on the clipboard so you can paste it into a GitHub issue.