Security and responsible disclosure

If you believe you've found a security vulnerability in Can They Email As Me? — including in result-link handling, account/domain verification, or DMARC report ingestion — please report it privately rather than opening a public issue.

How to report

Contact Suburban Secure through the support page. Include enough detail to reproduce the issue; avoid accessing, modifying or exfiltrating data beyond what's necessary to demonstrate it.

Scope

This tool only reads publicly published DNS/TLS/mail-transport records for the domain a user enters. It does not access mailboxes. Result links are unguessable tokens rather than password-protected — treat guessing/enumerating tokens as in-scope for responsible disclosure.