Security
Abuse Prevention and Privacy Design for a Temporary Inbox
How 10 Minute Temp Email limits abuse without claiming magic: receive-only mail, session cookies, hashed identifiers, optional Turnstile, cleanup, and responsible-use rules.
A public disposable inbox attracts two groups at once: people who want a short privacy buffer, and people who want a free identity farm. The design goal here is not to win an arms race in public. It is to make the legitimate loop easy and the harmful loop expensive, then delete the data.
This article explains the controls that are actually in the code. It does not publish secret values, exact numeric limits you can tune against, or advice for defeating another site’s defenses.
Privacy constraints the product is built around
- Short retention. Mailboxes last 10 minutes. Cleanup removes metadata and objects after expiry or deletion.
- Session ownership. The browser that created the mailbox holds an HttpOnly cookie. APIs refuse requests without a valid token hash.
- No mailbox IDs in the page. The UI gets the address and the timer, not storage keys.
- Hashed operational data. Session tokens are stored as HMAC hashes. Rate-limit keys use a hashed IP, not a raw address book of visitors.
- Referrer stripping. Site responses send
Referrer-Policy: no-referrerso other sites are less likely to see this origin in referrers.
None of that makes the operator blind. While a mailbox is alive, stored mail is readable by the system that stores it. The Privacy Policy says so. Do not put high-stakes secrets here.
Abuse constraints
Receive-only. There is no send path to hijack.
Recipient checks. Ingest accepts only the configured mail domain and an active local-part. Expired and unknown recipients are rejected without a chatty error.
Size and count caps. Oversized messages and full mailboxes are rejected so one sender cannot fill the store without bound.
Creation throttling. Mailbox creation is rate-limited. Cloudflare Turnstile can be required when enabled. Origin checks apply to mutating JSON routes.
Security headers. Responses include CSP (with the exceptions required for Astro hydration and Turnstile), X-Frame-Options: DENY, a permissions policy that disables camera/mic/geo/payment, and HSTS in production.
Policy. The Acceptable Use Policy forbids spam, phishing, fraud, malware, credential theft, automated farming, ban evasion, trial or coupon abuse that violates another service’s terms, and illegal activity. Report abuse is the contact path for operators who received mail from this domain.
What we will not help you do
If another website blocks disposable domains, that is their access control. Use a permitted address or skip the signup. This project will not document workarounds.
Temporary email is also the wrong tool for extra accounts, payment bypass, or identity games against someone else’s rules. Those are listed as prohibited uses because they harm other services and they are exactly the pattern advertisers and reviewers look for.
How this interacts with advertising
Ads, when enabled, are limited to the homepage (outside mailbox controls) and to original articles. They are not placed on legal pages, contact or abuse forms, or API responses. Creating a mailbox never requires clicking an ad. Details: Cookie Policy.
Related reading
