Security
We report what we find, and we build like it matters.
Security at m6l is a practice, not a page of adjectives. This is the public record: research we have reported to vendors, what it taught us, and the rules every m6l build follows.
Research
eBay: fraud instructions inside a genuine, signed security email.
In 2026 we found and reported a flaw in eBay's transactional email pipeline that let an attacker place arbitrary text, including a fraud phone number, inside real eBay security notifications. The messages were sent by eBay, signed by eBay, and passed every authentication check a receiving mail system runs. eBay confirmed the issue, fixed it, and accepted the finding for its Security Researcher Acknowledgments page. Reference RD-803DECCA.
How it worked
An attacker set the display name on an eBay account to lure text with a phone number, then triggered an ordinary account notification to the target. eBay's template rendered the name verbatim, so the victim received a legitimate eBay email telling them to call a scammer.
Why filters let it through
SPF, DKIM, DMARC, and ARC all passed, because nothing about the message was forged: the only lie was inside a field eBay signed. Three commercial mail filters delivered it. Authentication proves who sent a message, not whether its contents are safe.
How we handled it
Reported directly to eBay's security team with the full chain of custody, without creating test accounts or sending test messages to anyone. The recipient's details stay private, here and everywhere. The attacker's artifacts went to eBay.
What it taught us
Authentication is not safety.
A perfectly signed message can still carry a lie. That lesson shapes what we build: defenses that inspect what a message or a prompt actually says, not who it claims to come from. The first product from that work, Gated, is in early access and will have its own home soon.
How every m6l build is made
The rules we do not negotiate.
Supervised AI
In every AI feature we ship, a state machine owns the flow and the model only phrases its turns. Injection, pressure, or a policy violation trips a hard gate to a human. Nothing a model says is a price, a promise, or a commitment.
Claims have receipts
No factual claim ships without provenance: the client's own words, a verified public fact, or an attributed quote. That applies to client sites, to our products, and to this page.
Email done honestly
Our domains run DMARC at reject with SPF and 2048-bit DKIM. An unsubscribe takes effect the moment it is clicked, not in 24 to 72 hours, and a person answers if we ever get that wrong.
Clients own everything
Domains, accounts, and code are registered to the client from day one. We hold operating keys while we run things, and the handover is a documented, repeatable procedure, not a negotiation.
Small surface, strict headers
Content security policy on every page, private client documents served with no indexing and no referrers, and workers built with as few dependencies as possible so there is less to audit and less to break.
Measured, not asserted
This site scores 100 in every Lighthouse category on every page, including best practices. The floor for anything we ship is the same.
Responsible disclosure
Found something in ours? Tell us.
If you believe you have found a security issue in an m6l site, product, or service, write to [email protected] with "security" in the subject. A person reads it the same day. We will acknowledge receipt, keep you informed, fix what is real, and credit you here if you want credit. We will not take action against good-faith research that avoids harming users or data.
Record
Reported and shipped.
- 2026 eBay transactional email content injection, reported, confirmed, fixed (RD-803DECCA)
- 2026 m6l.ai launched at 100/100 across every Lighthouse category, CSP on every page