The problem

Third-party email content needed to remain useful and interactive without leaking malicious code, styles or scripts into the host CRM.

Constraints

• Untrusted HTML email content
• Support for images, PDFs, video and audio attachments
• Compatibility with external email synchronisation

How I approached it

Built sandboxed email previews, condensed and expanded message views, in-place attachment previews and reply flows synchronised through IMAP and SMTP.

My contribution

Owned frontend delivery and contributed across the supporting Node.js and NestJS services.

Outcomes

• Resolved critical XSS and CSS-leak vulnerabilities, reducing security risk exposure by more than 90%.
• Reduced support tickets related to email navigation by 50%.

What I learned

• Rendering untrusted content safely requires isolation boundaries that protect both the host interface and the user workflow.

Technology

Vue 3 / Pinia / TanStack Query / Node.js / NestJS / Cypress / IMAP / SMTP