> How is my subscription secure if authorisation key is made public? >> Emailyt needs authorisation key to validate your subscription, and the key is only vali

> How is my subscription secure if authorisation key is made public? >> Emailyt needs authorisation key to validate your subscription, and the key is only valid when using from the pre-configured website If this means that they are checking the Referer then of course that’s trivial to spoof. So anyone with CURL can trigger emails to be sent? Unless it’s a one-time key that’s generated on the backend to send a specific email (e.g. hash verified)... how can it truly be secure? Since these will be valid emails sent from the authorized domain sender, spoofing would be a big problem. Is this a Show HN?