OpenInbox is a free, self-hosted email service for your own domain that runs entirely inside your free Cloudflare account. You click a Deploy to Cloudflare button, paste a Cloudflare API token into its setup page, and a few minutes later you have a web inbox at you@yourdomain.com, with a dark mode, a mobile layout, search, labels, filters, snooze and scheduled send.
It replaces paying a few dollars per person per month for Google Workspace or Microsoft 365 when all you need is mail. Users, mailboxes, aliases, catch-all addresses and domains are unlimited, and an admin page sets up the SPF, DKIM and DMARC records for you and checks each domain's health. Receiving works on its own; to send, you connect a free account with Resend, Brevo or Mailjet, or any SMTP server, and it falls back to another provider when one hits its daily limit.
OpenInbox is MIT-licensed and maintained by the GitHub user sums001 with two other contributors. It was created on 23 October 2026, has about 375 stars, and version 1.0.0 came out on 27 October 2026. The README calls it beta and asks you to try it on a spare domain first.
- Repository: github.com/sums001/OpenInbox
- Licence: MIT (MIT License)
- Language: TypeScript. Stars: 375. Forks: 63. Last push: Nov 13, 2026.
- Scan: safe, Nov 14, 2026, commit 663be7c
Who it is for
Solo developers with side projects, small teams that want support@ and sales@ addresses, freelancers running several brands, and families on a personal domain. You need a domain on Cloudflare's nameservers and some comfort with DNS settings; no coding or terminal is needed.
Getting started
1. Move your domain's nameservers to a free Cloudflare account, if it is not there already
https://dash.cloudflare.com/2. Click Deploy to Cloudflare, then Deploy, keeping the default names
https://deploy.workers.cloudflare.com/?url=https://github.com/sums001/OpenInbox3. Open the Worker's workers.dev address and follow the setup page: create the token, save the recovery key, make your admin account
https://github.com/sums001/OpenInbox#deploy4. Connect a sending provider in Admin, Integrations
https://resend.com/The token you create lets OpenInbox edit your domain's DNS, Email Routing and Workers. The recovery key is shown once and is the only way back into the owner account, so put it in a password manager. Free storage is 500 MB, roughly 50,000 to 100,000 messages, and attachments are only kept on messages under 950 KB unless you turn on R2.
Safety scan
We cloned sums001/OpenInbox at commit 663be7c on Nov 14, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The 2 secret hits are not secrets: they are dummy BEGIN PRIVATE KEY strings in test/unit/core.test.ts that check the sender-logo certificate upload rejects keys. No committed binaries across 239 files and about 27,000 lines of TypeScript, and we found no eval, encoded blobs or hidden Unicode characters.
- 0 pattern hits. We also read where your mail and token go: every outbound request is to Cloudflare's API, the sending provider you choose, Cloudflare's DNS-over-HTTPS for sender logos, and GitHub's release API for the update notice. No hard-coded addresses, hidden copies or forwarding, and Email Routing only sends mail to your own Worker.
- Setup has no installer to run. The Deploy button builds the app with Vite and deploys it with Wrangler into your account; the dependency install scripts are the usual esbuild and workerd ones, all from the npm registry. Updates are manual: a Sync upstream workflow you start copies the maintainer's new release into your copy and Cloudflare redeploys it, so read the release notes first.
- 15 known advisories, none critical. The 5 high ones are in build and test tools (undici inside Wrangler, an older zod in the test plugin), not the deployed app. The app itself ships Hono 4.13.13 with 4 moderate and 1 low advisories, one of them about middleware skipped on some routes; the app uses its own CSRF check rather than Hono's.
- Two workflows: CI with read-only permissions, and the manual sync. No pull_request_target, and the actions used are GitHub's own, tagged by version rather than pinned to commits. No security policy file, Dependabot or CodeQL; the README asks for security reports through GitHub's private reporting. No analytics or telemetry.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 2 candidates found and read; see the notes above. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. No third-party actions. |
| Network hosts | 32 distinct hosts referenced from source; most often logos.test, a.test, dash.cloudflare.com, cdn.example.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 15 advisories across 409 pinned packages: 0 critical, 5 high, 9 moderate, 1 low. package-lock.json: 417 packages, 15 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (2, redacted)
| Where | Rule | Match |
|---|---|---|
| test/unit/core.test.ts:97 | private-key | -----B…--- (27 chars) |
| test/unit/core.test.ts:98 | private-key | -----B…--- (27 chars) |
Worst known vulnerabilities (15 of 15)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.6.5 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-2m5v-pch6-74hx | high | undici@7.29.1 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
| GHSA-4w7w-5xrc-9h26 | high | undici@7.29.1 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
| GHSA-qrxm-fqhp-jwvm | high | undici@7.29.1 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
| GHSA-xjj6-f33q-929c | high | undici@7.29.1 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-46wx-v44x-9hh2 | moderate | hono@4.13.13 | Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`) |
| GHSA-4h7h-rv7c-7m2v | moderate | hono@4.13.13 | Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters |
| GHSA-4m76-xfj5-7975 | moderate | hono@4.13.13 | Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix |
| GHSA-h7mg-cq63-vhpq | moderate | hono@4.13.13 | Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator |
| GHSA-g3hv-75wg-m249 | moderate | minimatch@10.2.6 | minimatch has potential denial of service via globparts amplification |
| GHSA-4qv8-2p9j-2685 | moderate | undici@7.29.1 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| GHSA-55wc-3pg8-jfw6 | moderate | undici@7.29.1 | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
| GHSA-9fm3-97px-rjf6 | moderate | undici@7.29.1 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
| GHSA-f72v-6w45-q472 | moderate | undici@7.29.1 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
| GHSA-3gg2-335m-rxc6 | low | hono@4.13.13 | Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML inj… |
By the numbers
| Stars | 375 |
|---|---|
| Forks | 63 |
| Contributors | 3 |
| Commits | 45 |
| Open issues | 6 |
| Open pull requests | 7 |
| Releases | 1 |
| Latest release | v1.0.0 |
| Licence | MIT |
| Main language | TypeScript |
| Project age | 3 weeks |
| Last push | Nov 13, 2026 |
| Tracked files | 239 |
| Lines of code | 26.9K |
| Checkout size | 12 MB |
Lines by language: TypeScript 25.4K, SQL 531, Markdown 298, CSS 273, JavaScript 235, JSON 134.
Questions
Is OpenInbox free?
Yes. It is free and open source under the MIT licence and runs on Cloudflare's free plan. You still pay for your domain, and sending uses a provider's free tier (Resend 100 a day, Brevo 300, Mailjet 200) unless you upgrade with them.
OpenInbox or Google Workspace?
Google Workspace if the mail is critical. OpenInbox is free for any number of people and keeps mail in your own Cloudflare account, but it is beta, has no calendar or documents, and you look after it yourself.
Does OpenInbox send my mail anywhere?
Only where mail has to go. Incoming mail is stored in your own Cloudflare D1 database, and outgoing mail goes through the sending provider you connect. Apart from a check of GitHub for new releases, we found no analytics or other outside calls.
Can I use OpenInbox for newsletters or cold email?
No. The README says it is for everyday conversations, and bulk or unsolicited mail can get your sending account banned and hurt your domain's reputation.
Do I need to know how to code?
No. Setup happens in the browser through the Deploy button and a setup page, but you need your domain on Cloudflare and to be comfortable creating an API token.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.