Domain Mail v1.2: demo without credentials
v1.2 introduces an explicit product boundary: employers can inspect a realistic webmail workflow in showcase mode without the service parsing passwords, connecting to IMAP or SMTP, or touching Supabase.
Showcase mode
- Starts with synthetic mailbox content and an explicit demonstration banner.
- Does not parse or retain real mailbox passwords.
- Does not open IMAP, SMTP or Supabase connections.
- Simulates read, unread, delete, send and reset workflows for interface evaluation.
Live mode remains a separate trust boundary
- Rotates the session on login and includes CSRF protection on authentication.
- Fails closed on production secret and cookie configuration.
- Adds request limits, CSP and security headers.
- Exposes separate liveness and readiness endpoints for operations.
Deployment design
The Render blueprint is intentionally showcase-only, uses one worker and contains no mail or Supabase secrets. This makes the public deployment contract safer and easier to audit.
At publication time the v1.2 branch is prepared but this post does not claim that the historical Render URL already runs it. The deployed commit and mode must be revalidated before labeling that URL v1.2.
Why this is stronger portfolio evidence
A safe showcase demonstrates product judgment as well as UI work: the public evaluator gets a useful experience, while live credentials and infrastructure stay outside the demonstration boundary.