BriefBox

• 

  Home Page

Inspiration

Signing up for random tools, newsletters, and one-off verifications shouldn’t mean handing over a permanent inbox. Most “temp mail” products feel either unreliable, ad-heavy, or blind to obvious phishing. We wanted something quieter and more intentional: one disposable address, one hour, then gone — with basic safety signals so you’re not clicking blind.

BriefBox came from a simple idea: temporary email should feel like a private workbench, not a public dumpster.

What it does

BriefBox is an anonymous temporary email service.

• Opens instantly — no signup, no login
• Issues a real address on your domain (e.g. x7k9p2@yourdomain.com)
• Session lasts exactly one hour, then self-destructs
• Receives real inbound mail via Cloudflare Email Routing
• Parses text + HTML and shows messages in a clean inbox
• Scores mail locally as Safe / Warning / Dangerous
• Stores everything in Redis only (no user database)
• Auto-cleans sessions and messages with TTL

You visit the site, copy an address, receive mail, read it with a risk badge, and when the timer hits zero — the address and inbox disappear.

How we built it

Monorepo with pnpm workspaces + Turborepo:

• Frontend: React Router (framework mode), cookie-aware API client for loaders + browser
• Backend: Fastify, HttpOnly session cookies, rate limiting, helmet, CORS
• Storage: Redis only — sessions, reverse email lookup, and messages with matching TTLs
• Inbound mail: Cloudflare Email Routing (catch-all) → Email Worker → POST /api/webhook/email
• Parsing: mailparser for MIME (subject, text, html, links)
• Safety: local rule-based scorer (phrases, shady links, brand mismatch, structure) — no LLM for speed/privacy
• UI: countdown, copy address, risk badges, sanitized HTML rendering

Key design choice: no accounts. A session is just a session_id cookie backed by Redis. Emails are stored as email:{sessionId}:{emailId} and wiped with the session.

Challenges we ran into

• SSR + cookies in Docker: loaders run inside the container, so localhost is not the host backend. We split browser vs server API base URLs.
• Path aliases in production: TypeScript ~/... imports survived tsc and broke Node ESM. Fixed with tsc-alias + .js extension rewriting.
• Cloudflare Email Routing: nameservers, catch-all, Worker secrets, and webhook wiring had to line up before a single real message appeared.
• False-positive safety scoring: early rules flagged normal “verify your email” product mail. We reworked brand-mismatch and weak-auth phrase logic so legitimate transactional mail stays mostly green.
• Keeping the product honest: tempting to add attachments, Gemini, and websockets — we cut scope so the core loop stayed solid.

Accomplishments that we're proud of

• A full real-mail loop on a custom domain, not a fake demo inbox
• Zero-account architecture that still feels like a product
• Fast local phishing heuristics with meaningful badges and fewer false positives
• Clean separation of session service, email service, webhook, and UI
• Dockerized web + backend builds for a pnpm monorepo
• A usable MVP: open → receive → scan → expire

What we learned

• Temp mail is as much infra + DNS + routing as it is UI
• Redis TTL is a powerful product feature when the whole model is ephemeral
• Safety scoring needs restraint: strong scam signals ≠ every “verify email” subject
• Production Node ESM is unforgiving about aliases and file extensions
• The best MVP constraint was time itself - one hour forced simplicity

What's next for BriefBox

• Server sent events (SSE) for true push updates instead of short polling/revalidate
• Hardened production deploy (Compose/K8s, monitoring, stricter rate limits)
• Attachment metadata display (still no malware file hosting)

Built With

• cloudflare-email-worker
• fastify
• mailparser
• pnpm
• react-router-framework
• redis
• tailwindcss
• turborepo
• typescript