Security

InboxAlarm reads DNS and sends alerts. Here's how the service itself is secured.

API-key auth: Set INBOXALARM_API_KEY to require X-API-Key on every endpoint except /health, compared in constant time.
Localhost by default: The server binds 127.0.0.1; expose it only behind a trusted reverse proxy with TLS.
Input validation: Domains are format-validated; request bodies are capped at 1 MiB; malformed JSON is rejected, not guessed at.
No secret logging: Structured logs record request metadata only. Alert payloads never include credentials.
Env-only config: Webhook URLs, SMTP credentials, and API keys live in environment variables — never in code.

Known limits (we'd rather you read them here)

With no API key set, the API trusts the network — keep it on localhost or behind a proxy.
DNSBL queries should run from the host's own resolver; public resolvers get refused by some lists.

Questions or a vulnerability to report? Contact us — security reports go to the top of the queue.