Open source
Built on code anyone can check.
Indo Mail stands on well-known open-source libraries. Here they all are, and here is our plan for our own code.
Libraries
What we use, and under which licence.
Taken from our software’s own list of dependencies each time this page is built.
| Library | Version | Licence |
|---|---|---|
| @simplewebauthn/browser | 13.3.0 | MIT |
| @simplewebauthn/server | 13.3.3 | MIT |
| bcryptjs | 3.0.3 | BSD-3-Clause |
| better-sqlite3 | 13.0.3 | MIT |
| compression | 1.8.2 | MIT |
| docx | 9.10.0 | MIT |
| docxtemplater | 3.71.1 | MIT |
| dotenv | 18.0.5 | BSD-2-Clause |
| exceljs | 4.4.0 | MIT |
| express | 5.2.1 | MIT |
| express-rate-limit | 8.7.0 | MIT |
| helmet | 8.3.0 | MIT |
| imapflow | 2.2.5 | MIT |
| jsonwebtoken | 9.0.3 | MIT |
| jszip | 3.10.2 | (MIT OR GPL-3.0-or-later) |
| mailauth | 7.1.1 | MIT |
| mailparser | 3.9.35 | MIT |
| mammoth | 1.13.0 | BSD-2-Clause |
| multer | 2.4.0 | MIT |
| nodemailer | 10.0.14 | MIT-0 |
| pdf-lib | 1.17.1 | MIT |
| pizzip | 3.3.0 | (MIT OR GPL-3.0) |
| pptxgenjs | 3.12.0 | MIT |
| sanitize-html | 2.18.0 | MIT |
| smtp-server | 3.19.17 | MIT-0 |
| noble-post-quantum (ML-KEM-768, in the browser) | 0.7.1 | MIT |
| simplewebauthn browser (passkeys, in the browser) | bundled | MIT |
The full licence texts are in our open-source licences file.
Our own code
Where we are, honestly.
- The code of Indo Mail itself is not open source today.
- Our plan is to publish, for public review, the code in our web and phone apps that creates keys and locks and unlocks your data, so that anyone can check it does what this site says. We will announce it here and in What’s new when it is published.
- Until then, anyone can see the encryption at work: the code runs in your browser, and the locked data it sends to our servers can be inspected with the browser’s own developer tools.
- Security researchers are welcome to test Indo Mail under our responsible disclosure rules.
Spotted a problem?
Tell us at security@indoemail.in. We reply within 2 working days.