Email walls

Signups send codes and magic links. With a catch-all domain forwarded to an IMAP inbox, every prospect gets its own address and reads its own mail.

Set up a mailbox

Copy .env.example to .env and fill it in. Never commit .env.

LEAKDOWN_IMAP_HOST="imap.gmail.com"
LEAKDOWN_IMAP_USER="you@gmail.com"
LEAKDOWN_IMAP_PASS="xxxx xxxx xxxx xxxx"   # an app password
LEAKDOWN_MAIL_DOMAIN="yourdomain.com"      # catch-all forwarded to that inbox

Test it

One command checks the whole mailbox round trip.

leakdown --mailtest   # create, receive, extract and destroy a mailbox  ✅ mailbox created: momus.4f1c@yourdomain.com
  ✉ probe 1 sent via SMTP — a second follows at 60s. Waiting up to 5 minutes.
  (a self-sent probe proves SMTP + IMAP; to prove the forwarder, also send one to that address from another account now)

  📬 arrived after 14s: probe 1

• Every run checks the mailbox once a day. If two prospects blame email and nothing arrived, those verdicts are marked unverified.
• Each prospect's mail moves to Trash when its session ends. It is not purged.

Without mail

Prospects treat "check your email" as the point they leave, and the report says so. That is useful when you want to know how many people a verification step loses, and misleading when you don't.