Security
MailFlare, by MailFlare Labs. Updated 28 October 2026.
MailFlare reads your mail, so we take its security seriously and welcome reports from anyone who finds a problem. Our contact details are also published at /.well-known/security.txt.
Report a vulnerability
Email security@mailflarelabs.com with a description, the MailFlare version (shown in the app's Settings window), and steps to reproduce. Please don't open a public issue or post about it before we've had a chance to fix it.
- We acknowledge your report within 3 business days.
- We aim to fix or mitigate within 30 days for issues that expose mail data or the Google sign-in token, and within 90 days for everything else.
- We credit you in the release notes, if you'd like.
We ask that you give us that window before disclosing publicly, and that you test only against your own Google account and your own Mac.
Scope
In scope:
- The MailFlare app: Google sign-in, token storage, checking Gmail, rule matching, alert windows, configuration handling, and how the app is built.
- This website, mailflarelabs.com, which is a set of static pages.
Out of scope:
- Google's sign-in and Gmail services themselves. Report those to Google.
- Attacks that need the attacker to already run code as you on your Mac. At that point no app on the machine can protect you.
- Flooding someone with matching mail to trigger many alerts.
Once MailFlare is on the Mac App Store, security fixes go to the current release there.
How MailFlare limits the damage
- MailFlare asks Google for one permission, read-only Gmail access. It can never send, modify, or delete your mail.
- There are no MailFlare servers. Your mail and your account data stay on your Mac.
- Your Google sign-in token is kept only in the macOS Keychain. Signing out revokes it with Google.
- Sign-in uses Google's recommended protections for desktop apps (PKCE and a one-time state check), with the reply received only on your own Mac.
- The app runs in Apple's App Sandbox and links no third-party code, only Apple's own frameworks. Release builds will use Apple's Hardened Runtime and be notarized or signed for the App Store.
- Mail text is shown as plain text, never rendered as a web page, and characters that could disguise text are stripped first.
- The diagnostic log leaves out sender addresses and subjects unless you turn on verbose logging for troubleshooting.
Behind this sits a written security review mapped to the OWASP Top 10, a threat model of every component, and automated checks that run on every code change.