It could be implemented in a secure way, without using a URL as you mentioned. The email client could support plug-ins (Thunderbird does I believe), the user wo

It could be implemented in a secure way, without using a URL as you mentioned. The email client could support plug-ins (Thunderbird does I believe), the user would authorize the plug-in to connect with his Pivotal account and the data inside the JSON payload would be used to render a Pivotal story. With other words: an augmented email client could do things with payloads inside emails that are far beyond what email clients do nowadays and I believe it can be done in a secure manner.