Security
This page summarizes how the current application handles sign-in, Gmail, and unsubscribe. It is not a formal audit or a claim of zero risk.
Google sign-in validates OAuth state and uses PKCE. Session cookies are HttpOnly and SameSite=Lax, and they are marked Secure in production. OAuth tokens stay in server process memory for the active session and are not stored in the browser.
The browser never calls Gmail. Scan, metadata reads, and user-selected Trash moves run on the server. Execution endpoints accept sender-group choices, not Gmail message IDs supplied by the browser.
Automatic unsubscribe runs on the server against the mechanism advertised on the email. Targets are checked before the request is sent. The browser does not supply unsubscribe URLs for execution.