-
Notifications
You must be signed in to change notification settings - Fork 0
Security and Privacy
InLook's entire purpose is to open an email — including a hostile one — safely. The design reflects that.
Opening an email file should never let that email run code, track you, or reach the network. Email is attacker-controlled input, so InLook treats every file as potentially hostile.
HTML email bodies are rendered with two independent layers of containment:
- An empty-sandbox iframe (
sandbox="") — this disables scripts, forms, popups, top-navigation, downloads, and same-origin access, unconditionally. - A strict Content-Security-Policy inside that iframe — no remote anything; inline
data:images only.
If one layer were ever bypassed, the other still contains the content. On top of that, every header, address, subject, and attachment name is HTML-escaped, so nothing from the email can inject markup into InLook's own interface. No script from email content ever runs.
Remote images and tracking pixels are blocked — opening a message never tells the sender you read it. Embedded (cid:) images still display, because they are rendered from bytes inside the message itself, never fetched.
Attachments are listed but inert until you act. Saving is always an explicit Save As with a sanitized filename; InLook never auto-opens or executes an attachment. Attached emails open in a new InLook window (same safe renderer).
InLook has no telemetry and phones nothing home. Email content stays on your machine.
The only time InLook makes a network connection is if you explicitly opt in to the update check (Windows only). On first run it asks once. If you say yes, it occasionally contacts github.com over HTTPS — using Windows' own secure connection stack, with no third-party HTTP or TLS code compiled in — to read the latest release tag and, at most once per version, tell you a newer version exists. It never downloads or installs anything, and sends no information about you or your email. If you say no (or never opt in), InLook makes no network connection at all.
You can change your choice any time via the registry value HKCU\Software\StruisICT\InLook\UpdateCheckEnabled (0 = off, 1 = on).
Windows release binaries are Authenticode-signed via SignPath Foundation's free open-source program. Builds are produced from source by GitHub Actions and signed per release after manual approval.
Found a security problem? Please open an issue at https://github.com/StruisICT/InLook/issues (or contact Struis ICT for anything sensitive).