HTML Email Rendering & Sandboxing
Untrusted HTML in email is a real attack surface. The plan is a sandboxed rendering pipeline — nothing on this page is built yet.
HTML sanitization — not implemented yetThe Design: Sandbox First
The intended approach, per the project's own security conventions, is to render untrusted HTML email inside an <iframe sandbox> with JavaScript disabled, rather than trusting a webview to render remote content directly. That includes stripping remote tracking pixels and blocking external script and style injection before anything reaches the renderer.
Sandboxed iframe rendering inside the planned desktop client — not built.
A plain-text or Markdown fallback for non-GUI clients is the intended direction, once those clients exist.
HTML sanitization is exactly the kind of security-sensitive surface we'd rather ship correctly and later than ship early and wrong. It's tracked as a real milestone on the roadmap, not a checkbox feature.