alt Hacker NewsThe thing with all these vibe-coded email clients is: how well do they sanitize the full-content view of HTML emails? Thunderbird and the like go to great lengths to make viewing those emails safe, e.g., by preventing inline JavaScript and all kinds of tracking techniques (pixels, CSS references, etc.). Without having checked, do these vibe-coded clients just render the HTML in a WebView, or do they have similar protections in place?
This is actually a very tricky problem. We solve this by never rendering mails in trusted origin. It's basically sanitisation + isolated sandboxed iframe for defence in depth + standard security stuff like CSP headers. When I was looking into this, I was surprised how many popular mail clients relay primarily on sanitization and render mails within trusted origin (ex: marco, superhuman).
Other interesting problem to solve for mail clients is the editor. You should be able to forward/edit untrusted html content. Source: I develop tecotype.com for mac/linux/windows.