Nocturnal Post 0.24: one pipe for email, deeper security screening, and business context

We just closed one of the busiest build weeks in the project's history — twelve releases in three days. Here's what shipped, in plain terms, and why each piece matters if you run a small team that lives in email.

One pipe for every email the platform sends

Until now, Nocturnal Post's outgoing mail (briefings, alerts, invites) used a per-tenant service sender. In 0.24, all system email rides a single comms pipe: a transactional email API that renders per-tenant templates, sends, and tracks every message individually.

What you get from that:

* Per-send tracking. Every briefing and alert has a delivery record — status, timestamps, outcome. No more "did it send?" guesswork.

* Live template editing. The admin settings page can edit and preview email templates. No redeploy, no restarting anything.

* One identity. Mail comes from one aligned, authenticated sender instead of per-tenant senders — better deliverability, simpler allowlisting, cleaner SPF/DKIM/DMARC alignment.

* A kill switch. Disabling the pipe falls back to the previous sending chain instantly, without a redeploy. Your briefings don't depend on any single component being perfect.

Passwordless sign-in

You can now sign in with a link instead of a password. Enter your email, get a single-use link (valid 15 minutes), click, and you're in.

The design principle is the same one that powers our IMAP signup: the mailbox itself is the proof of identity. The link can only be delivered to the mailbox being signed into. No password to reuse, forget, or phish.

Existing sign-in methods are unchanged — Microsoft and Google OAuth are still there, and IMAP users now have a passwordless option for the first time.

A new layer of attachment screening

Phishing doesn't always arrive as text. Hidden-payload detection (shipped in 0.24.7) scans attachments at sync time for steganography indicators:

* Data appended past a PNG or JPEG's official end-of-file marker

* Embedded archive/document containers (ZIP, RAR, 7z, PDF) hidden inside image files

* Statistically anomalous pixel data consistent with least-significant-bit steganography

* Suspicious objects in PDFs (embedded files, JavaScript)

Messages carrying suspicious attachments are flagged at threat severity with sandbox-first guidance. This joins the existing screening stack — SPF/DKIM/DMARC header analysis and lookalike-domain/business-email-compromise detection — as another filter between your team and hostile mail.

The detection algorithms are open source (AGPL), like the rest of the classification engine.

Business context that reads your industry

Business tenants can now maintain a Business Profile: legal name, website, NAICS industry codes, and a description of what the company does.

That profile powers something genuinely new: when an email reads as a request for proposal — RFP, RFI, RFQ, sources-sought — Nocturnal Post searches the federal government's SAM.gov opportunities database and attaches matching notices to the follow-up item, with deadlines and links. The search is filtered through your industry codes, so an IT services firm sees IT solicitations, not shipbuilding contracts.

The feature is deliberately quiet: it fails silently when unconfigured, never blocks mail, and your profile is your own data — you manage it on your Business Profile page.

Three more ways to get your briefings

Briefings previously arrived by email and Microsoft Teams. Three channels joined them:

* Google Chat — incoming webhooks, per-tenant

* Slack — incoming webhooks, pinned to Slack's official hook host

* Everything rides the same scheduling engine — Dawn, Dusk, Moon, and Upcoming briefs, business or personal cadence

Also in this cycle

* IMAP onboarding for everyone: self-serve signup with an app password, an invite flow for teams, and automatic host detection for well-known providers. No OAuth required.

* DMARC aggregate report ingestion: hourly, automatic, feeding a tenant-facing Intel Hub.

* Agent-readable manifests (`llms.txt` and `/.well-known/agent.json`) describing the service and its signup contract for AI agents.

* A full internal penetration test — and same-day remediation of both high findings: restored webhook signature verification (a deployment-split regression) and per-IP login rate limiting behind our proxy (eliminating a platform-wide lockout vector). We also added HSTS and throttled magic-link issuance. The test's positive findings — the SSRF guard, access-gating coverage, session hygiene — held everywhere they were probed.

What's next

On the near-term list: richer SAM.gov matching, an intel feed registry (Internet Storm Center first), agent-facing API depth, and authenticated tenant-isolation testing as the next security engagement.

Self-hosting remains free under AGPL-3.0. The hosted service is at nocturnalpost.com — $10/seat with a 30-day retention default and a privacy-first data model.