01
Authenticated ownership checks
Protected server functions require a signed-in workspace and verify ownership before domain, mailbox, template or campaign mutation.
Clear boundaries
for accounts,
mailboxes and keys.
This page documents controls represented in the application. It does not claim certifications, encryption modes, authentication factors or bounty payments that have not been independently established.
02
API-key lifecycle
Keys are generated with an hm_ prefix, validated by SHA-256 hash, may have an encrypted reveal copy, and can be revoked independently.
03
Credential separation
Workspace sessions administer the product; mailbox credentials access one mailbox; API keys authorize developer endpoints.
04
Server-side provider secrets
Appwrite service credentials, Paystack secrets and mail-server credentials remain in the server environment rather than public client configuration.
05
Scoped application data
Queries scope operational records to the authenticated user or selected mailbox, with additional ownership checks before changes.
06
Safer delivery validation
Campaigns validate template ownership and state, audience, duplicate addresses and available credits before final confirmation.
What customers control
- Use unique workspace and mailbox passwords.
- Keep raw API keys only in trusted backend secrets.
- Label keys by application and revoke unused credentials.
- Review API usage and unexpected delivery activity.
- Never send credentials through support or public forums.
Responsible disclosure
Send a concise report to security@hihemax.com with the affected surface, reproduction steps, impact and safe evidence. Do not access other users’ data, degrade service or publish details before the issue can be investigated.
security@hihemax.comSecurity documentation should evolve with implemented controls and verified external assessments. If a certification or security feature is not listed here, do not assume it is available.
Read operational security guidance