Current surface
The public site uses static files. Preview output is rendered without executing arbitrary user JavaScript. Generated code contains no FormToInbox secret.
Trust
Security at FormToInbox
The current builder runs in the browser and does not receive generated form submissions. Hosted processing remains disabled while its controls are built and tested.
Hosted service gate
Authentication, tenant isolation, rate limiting, webhook verification, audit logs, backups and secure file handling must pass negative tests before activation.
Responsible reporting
A verified security contact will be published before accounts or submission data are accepted.